Version 4 · 26/10/2026
You use NEXT as part of a training course or a consulting assignment delivered by AGILEA, whether your employer enrolled you or you are taking it in a personal capacity (CPF, self-funded). This page explains which data about you is used in NEXT, why, for how long, and how to exercise your rights.
The administrative documents of the training course (enrolment, agreement, certificates) are handled outside NEXT and are not covered by this page.
This is a translation; the French version prevails.
1. Who is responsible for your data?
AGILEA FRANCE (“AGILEA”), GOLF PARK – Bât. E, 1 Rond Point du Général Eisenhower – 31100 TOULOUSE – FRANCE. Simplified joint-stock company (SAS) with a sole shareholder, share capital €100,182 · Toulouse Trade and Companies Register (RCS) 510 300 908 · EU VAT number: FR42 510 300 908. Registered training organisation no. 73 31 05470 31.
AGILEA publishes the NEXT platform and uses it for its training courses and consulting assignments: it is the controller of your data within the meaning of the GDPR (Regulation (EU) 2016/679).
Contact for any question about your data: rgpd@agilea-group.com.
Account opened by your company: if you use NEXT with an account that your company subscribed to for its own teams, your company is responsible for your data; please refer to its own rules. AGILEA then acts on its behalf.
2. What data?
- Your identity: last name, first name, e-mail address, language.
- Your affiliation: your company, your site or your team, if your employer enrolled you and this information is useful for the programme.
- Your progress: modules followed, progress, quiz answers and scores.
- What you post: messages, comments, files, content of collaborative whiteboards.
- Technical data: IP address, browser type, login dates, log of the actions performed on the platform.
NEXT does not ask you for any sensitive data (health, opinions, origin…). Please do not enter any in free-text fields.
3. Where does it come from?
- Enrolled by your employer or your organisation: your last name, first name and e-mail address are sent to AGILEA by them.
- Enrolled in a personal capacity: you provided them to AGILEA when you enrolled.
AGILEA then creates your account and invites you to the training workspace; there is no open registration. The other data comes from your use of the platform.
4. Why, and on what basis?
| Why | Legal basis |
|---|---|
| Creating your account, giving you access to the platform and sending you service e-mails (access, password reset, notifications) | Depending on your situation (below) |
| Following your progress: progress, quizzes, collaborative work | Depending on your situation (below) |
| Answering your support requests | AGILEA’s legitimate interest in assisting you |
| Ensuring the security of the platform and diagnosing problems | AGILEA’s legitimate interest in providing a safe and reliable service |
Depending on your situation:
- enrolled by your employer or your organisation: AGILEA’s legitimate interest in delivering the training course or assignment they ordered. This means that AGILEA needs this data to deliver the service, without using it for anything else and with respect for your rights; you may object to it (section 10);
- enrolled in a personal capacity: performance of your training contract with AGILEA.
AGILEA makes no automated decision about you and does no profiling. Your data is never sold or used for advertising purposes.
5. Who has access to it?
- AGILEA’s trainers and consultants who run your programme.
- The other participants in your training workspace, for what you share there (messages, collaborative work).
- Your employer, if they enrolled you: they receive no data about your progress in NEXT, unless the training agreement concluded with them provides for a report on your progress and quiz results.
- AGILEA’s technical team, to operate and secure the platform.
- AGILEA’s technical service providers, who act on its instructions:
| Subprocessor | Service | Data concerned | Location | Transfer outside the EU |
|---|---|---|---|---|
| Scaleway (Iliad), 8 rue de la Ville-l’Évêque, 75008 Paris, France | Platform server, file storage, backups, log centralisation (Cockpit), alert e-mails (TEM) | All platform data | France (Paris) | No |
| OVHcloud, 2 rue Kellermann, 59100 Roubaix, France | Backup copy of files and backups; monitoring and error tracking server | All data (backup copy); error messages with the user’s identifier and e-mail address | France | No |
| Brevo | Sending the platform’s and the authentication e-mails | E-mail address, company name, content of notifications | France / EU | No |
| Miro, Inc. | Collaborative whiteboards, an option enabled at the customer’s request | Content entered on the whiteboards, users’ IP address and browser | United States | Yes, if the option is enabled |
6. Does your data leave the European Union?
Your data is hosted in France. Several services may however involve a transfer outside the European Union:
- Miro collaborative whiteboards used during training: their content, your IP address and information about your browser are processed by Miro, Inc. This transfer is governed by the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
- The videos in some training modules, hosted by YouTube (Google) or Vimeo, sometimes through the Embedly service: when a lesson containing a video is displayed, your browser connects to these services, which receive your IP address and information about your browser, and may set their own cookies. AGILEA sends them no data; these services apply their own privacy rules.
- Articulate, publisher of the tool used to design some modules: when these modules are opened, your browser sends it a usage measurement (hashed learner identifier, browser, screen, language).
7. For how long?
| Data | Duration |
|---|---|
| Account, progress, work | 3 years after the end of the programme |
| Content shared with the other participants | Kept without your name after your account is deleted, until the training workspace is deleted |
| Support requests | 3 years after the last exchange |
| Detailed log of actions (for diagnosis) | 30 days |
| Login and security logs | 1 year |
| Technical errors | 90 days |
| Backups | Deleted data disappears from them at the latest 45 days after its deletion |
After that, the data is deleted. Platform usage statistics are kept as counters, without any data about you.
8. How is it protected?
- Hosting in France: server and storage at Scaleway (Paris), backup copy at OVHcloud (France), providers certified ISO/IEC 27001.
- Encrypted data: HTTPS connections (TLS 1.2 or 1.3), server data on an encrypted volume (AES-256) unlocked manually by an administrator, files encrypted with a key specific to each company, backups encrypted before they are sent.
- Segregated access: each company only sees its own data; AGILEA does not access their content through the application unless invited to; technical access to the servers is restricted to three named administrators, using personal keys.
- Centralised authentication, passwords never stored in clear text, password policy configurable by each company, two-factor authentication available.
- Server protection: firewall, web application firewall (OWASP), blocking of repeated login attempts, automatic security updates, daily antivirus and rootkit detection.
- Backups every 15 minutes, copied to a second hosting provider, kept for 45 days at most.
- Logging and monitoring: logs centralised in France, continuous monitoring of availability and scheduled tasks, alerts to the technical team.
9. Cookies and storage in your browser
NEXT uses no advertising or audience measurement cookies. It only uses:
- a session cookie, to keep you signed in;
- a cookie that remembers the last workspace you visited, to take you back to it (kept for 1 year);
- your browser’s local storage, for your session and a technical identifier used to diagnose errors.
Miro whiteboards and the videos embedded in some modules (YouTube, Vimeo) may set their own cookies, including audience measurement cookies, under the rules of those services.
10. Your rights
You may ask to access your data, have it rectified or erased, restrict its use, or object to its use on grounds relating to your particular situation (when the legal basis is legitimate interest). If you enrolled in a personal capacity, you may also receive the data you provided in a machine-readable format (portability). Finally, you may set instructions regarding what happens to your data after your death.
To exercise these rights, write to rgpd@agilea-group.com. AGILEA will reply within one month, which may be extended by two months for a complex request; you will then be informed. Proof of identity may be requested if there is doubt about your identity.
If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
11. Changes to this policy
This policy may change, in particular as the platform evolves. The date of the latest version is shown at the top of the document; in the event of a significant change, you will be informed by e-mail or in the platform.