Legal Notice

ARTICLE 1 – Normative Framework, Legal Personality, Full Institutional Standing, and Statutory Registration in the Official Systems of the French Republic (data.gouv.fr / DINUM / INSEE / SIRENE)

I. – In the sphere of free private higher education, third-cycle doctoral research, and transnational executive education, the effective protection of personal data constitutes a statutory pillar structuring public academic probity, the permanent traceability of conferred degrees, and the legal security of enrolled students and alumni of the EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS). In direct application of the principle of accountability enshrined in Article 5, Paragraph 2, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR), and consistent with the settled case law of the Court of Justice of the European Union (Cases C-210/16 Wirtschaftsakademie, C-40/17 Fashion ID, and C-311/18 Schrems II), the institution structures its data governance system pursuant to the deliberative and technical benchmarks established by the Commission Nationale de l'Informatique et des Libertés (CNIL) of the French Republic.

II. – Pursuant to Articles 12, 13, and 14 of the GDPR and domestic French legislation (Law of 1 July 1901 on the Association Contract [PDF] and the Code de l'éducation [PDF]), the statutory, registral, and fiscal identification of the Data Controller is formally established as follows, verifiable across the official databases of the French State:

1° Official Registered Designation of the Data Controller:

• a) Registration Designation in the French Republic: UNIVERSITÉ EUROPÉENNE DE PARIS (operating jointly under the statutory acronym and institutional identifier EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS), and its official Spanish denomination UNIVERSIDAD EUROPEA DE PARÍS, in full conformity with the Legal Notice and Statutory Impressum [PDF]).
• b) Legal Personality and Statutory Nature: Private free higher education establishment incorporated as a declared non-profit association under French private law (Association déclarée, official INSEE Legal Category 9220), governed by Articles 1, 2, and 5 of the Law of 1 July 1901 and by Book VII, Title III of the Code de l'éducation (Article L. 731-1 [PDF]).
• c) Seniority and Uninterrupted Thirty-Five (35) Year Standing: Founded in Paris on 11 June 1991, attesting to over thirty-five (35) years of continuous administrative operations (Administrative Status: ACTIVE) in the official registries of the French Republic.

2° Statutory Identifiers, Statistics, and Fiscal Records with the French State:

• a) Unique SIREN Identification Number (INSEE): 399 107 937 (Official INSEE SIRENE Certificate — PDF).
• b) SIRET Number of Head Office Establishment: 399 107 937 00019 (SIRET Establishment Record with Official Map — PDF).
• c) National Association Directory Number (RNA): W751108902 (Prefecture of Police of Paris).
• d) Principal Activity / NAF-APE Codes: 94.99Z and 94.99Y (Statutory activities of member organisations, higher training, academic research, and collegiate dissemination).
• e) Statutory Belonging to the Social and Solidarity Economy (ESS): Recognized by operation of law under French Law No. 2014-856 of 31 July 2014 (est_ess : true in inter-administrative databases).
• f) Intra-Community VAT Number: FR55399107937 (Article 286 ter of the French Code général des impôts).
• g) Global Legal Entity Identifier (LEI): 9695003637S275T57497 (GLEIF standard).

3° Registered, Rectoral, and Administrative Seat in Paris: 229 boulevard Voltaire, 75011 Paris, French Republic (INSEE Commune Code 75111, Department 75, Region 11 — Île-de-France), with historical complementary academic premises at 18 rue de Londres, 75009 Paris.

ARTICLE 2 – Collegiate Governance, Data Protection Officer (DPO), PRADA Legal Office, and Official Communication Directory

I. – Pursuant to Articles 37, 38, and 39 of the GDPR, and Article L. 330-1 of the French Code des relations entre le public et l'administration (CRPA), institutional governance, administrative transparency, and data protection oversight are conducted through the following designated offices:

II. – Legal Standing of Registral Centralisation in the Transnational Arena: The full recital of official French State identifiers (SIREN 399 107 937, SIRET 399 107 937 00019, RNA W751108902, LEI 9695003637S275T57497, and VAT FR55399107937) confers unassailable legal probity upon students and graduates. Both during expert evaluation and international Hague Apostille procedures and during algorithmic or documentary verification, the provenance of the academic dossier remains indissolubly linked to a recognized French corporate legal entity establishing thirty-five (35) years of verifiable standing within the official directories of the French Republic.

ARTICLE 3 – European Normative Hierarchy (GDPR) and French Domestic Legislation (Loi Informatique et Libertés)

I. – All personal data processing operations conducted by EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS) — including collection, structuring, storage, cryptographic validation, regulated transfer, and secure destruction — are directly and mandatorily governed by European Union law and the positive legal order of the French Republic:

1° Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR):

• a) Article 3 (Territorial Scope): Direct subjection to the GDPR by virtue of the Data Controller's main establishment in Paris (French Republic), guaranteeing an identical high level of European data protection to all students, applicants, faculty members, and graduates, regardless of nationality or country of residence (including Latin America — LATAM and the rest of the world).
• b) Article 5 (Principles Relating to Processing): Strict adherence to the principles of lawfulness, fairness, and transparency (Art. 5.1.a), purpose limitation (Art. 5.1.b), data minimisation (Art. 5.1.c), registral accuracy (Art. 5.1.d), storage limitation (Art. 5.1.e), integrity and confidentiality (Art. 5.1.f), and proactive accountability (Art. 5.2).
• c) Articles 6, 7, 8, and 9 (Lawful Bases and Special Categories): Every processing operation is strictly grounded upon the performance of the educational contract (Art. 6.1.b), compliance with French and European legal obligations (Art. 6.1.c), proportionate institutional legitimate interest in cybersecurity and anti-fraud diploma authentication (Art. 6.1.f), or specific, freely given, and informed consent (Art. 6.1.a), as well as heightened safeguards for scientific and clinical research projects (Art. 9.2.a, Art. 9.2.j, and Art. 89).
• d) Articles 12 to 22 (Rights of the Data Subject) and Articles 24 to 39 (Security and Governance): Comprehensive protection of data subject rights, privacy by design and by default (Art. 25), binding data processing agreements (Art. 28), master records of processing activities (Art. 30), cryptographic and logical security measures (Art. 32), notification of personal data breaches within seventy-two (72) hours (Arts. 33 and 34), and data protection impact assessments (Art. 35).
• e) Articles 44 to 49 (International Transfers): Systematic execution of the European Commission's Standard Contractual Clauses (Art. 46.2.c) and supplementary technical safeguards during cross-border data transfers outside the European Economic Area (EEA).

2° Domestic Legislation of the French Republic (Loi Informatique et Libertés and CNIL Deliberations):

• a) French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files, and Civil Liberties (as amended by Law No. 2018-493 and Ordinance No. 2018-1125): Domestic statute complementing the GDPR across French territory and establishing the regulatory and enforcement regime of the Commission Nationale de l'Informatique et des Libertés (CNIL).
• b) Article 82 of French Law No. 78-17: Transposition into French law of Directive 2002/58/EC (ePrivacy), governing the storing or accessing of information on terminal equipment (cookies and trackers), mandating prior informed consent for any device not strictly necessary for the technical provision of the service.

ARTICLE 4 – Interconnection with the Higher Education and Research Corpus and Exclusion of Generic Legal Bases

I. – The institution's statutory capacity to organize higher education curricula, direct doctoral research, and confer university credentials derives from the following statutory enactments within our official legislative library:

• a) Article L. 151-1 of the Code de l'éducation (PDF) : Constitutional and statutory guarantee of the freedom of higher education in the French Republic.
• b) Article L. 613-2 of the Code de l'éducation (PDF) : Statutory authority governing institutional degrees and interuniversity qualifications (Interuniversity Diploma — DIU / DIU-DOCTORAT and University Diploma — DU).
• c) Article L. 731-1 of the Code de l'éducation (PDF) : Statutory framework governing the opening and operation of free private higher education institutions.
• d) Article L. 444-1 (PDF) and Article L. 444-8 of the Code de l'éducation : Regulatory framework governing distance education and formal student contract protections.
• e) Article L. 718-16 of the Code de l'éducation (PDF) : Statutory regime governing international interuniversity cooperation conventions for joint supervision, cotutelle, and collaborative certification.
• f) Article L. 123-3 of the Code de l'éducation (PDF) : Cardinal higher education mission encompassing lifelong learning and elite executive specialisation up to Level 8 of the European Qualifications Framework (EQF Level 8).
• g) Article L. 412-1 of the Code de la recherche (PDF) and Decree (Arrêté) of 25 May 2016 (PDF) : Third-cycle doctoral training for research and scientific innovation.

II. – Binding Doctrine of Strict Separation between Educational Empowerment and GDPR Lawful Bases: It is established as a mandatory internal statutory norm that the aforementioned provisions of the Code de l'éducation and Code de la recherche establish the legal personality, educational mandate, and credentialing authority of the University, but cannot be invoked as a derogation nor as a generic catch-all legal basis substituting for Article 6 of the GDPR. Each personal data processing operation performed by the institution rests autonomously, explicitly, and verifiably upon one of the specific lawful bases exhaustively enumerated in Articles 6 and 9 of the GDPR.

ARTICLE 5 – Statutory Classification of Data Subjects and Educational Delivery Architecture

I. – To apply proportionate technical and legal safeguards to each constituency, the institution classifies data subjects into four (4) distinct statutory categories:

• 1° Applicants and Prospective Candidates for Admission: Higher education graduates and professionals seeking entry into university programmes, submitting prior degrees, identity records, and curricula vitae for academic pre-evaluation.
• 2° Enrolled Students and Doctoral Researchers: Active participants matriculated in Postgraduate Doctoral Programmes (DIU-DOCTORAT), University Masters, University Diplomas (DU / DIU), or Executive Higher Education curricula.
• 3° Alumni and Degree Holders: Individuals who have completed degree requirements and obtained university credentials, whose master records are permanently preserved in the University's Historical Registry.
• 4° Faculty, Clinical Mentors, and External Board Examiners: Professors, practicum directors, dissertation advisors, and defense board members participating in academic delivery, clinical oversight, or oral examinations.

ARTICLE 6 – Master Record of Processing Activities (Article 30 GDPR)

I. – In accordance with Article 30 of the GDPR, the University maintains a centralized Master Record of Processing Activities, structured as follows:

ARTICLE 7 – Public Academic Faith, Indivisible Master Dossier Unit, and Cryptographic QR Code Architecture

I. – The permanent preservation of graduation dossiers, solemn A3 format Degree Parchments, and European Diploma Supplements (SET) constitutes an essential public-interest function of the EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS). The academic dossier of each graduate forms an indivisible documentary and legal matrix unit, identified by a unique institutional matriculation number, comprising:

• 1° The Main Body of the Degree Parchment and European Diploma Supplement (SET / Diploma Supplement): Structured in strict adherence to the eight (8) standardized sections established jointly by the European Commission, the Council of Europe, and UNESCO/CEPES.
• 2° Annex A (Audited In-Person Practice Logbook): Certifying the volume of supervised clinical, professional, or forensic direct in-person practice (representing, in the benchmark doctoral curriculum, 57.27% of the total workload, comprising 4,948 hours and 2,467 audited clinical acts).
• 3° Annex B (Summative Assessment Battery): Evaluated rigorously pursuant to the official French university grading scale of 0.00 to 20.00 points.
• 4° Annex C (Doctoral Dissertation and Original Scientific Research): Documenting original research investigation and the formal defense minutes before the academic board of examiners (Jury de Thèse).

II. – The electronic verification of documentary authenticity operates pursuant to the following cryptographic standards and in strict compliance with Privacy by Design (Art. 25 GDPR):

• a) Official Cryptographic Validation Portal: The two-dimensional QR code affixed to each degree and academic transcript links directly to the secure institutional verification platform (https://www.saejee.eu/verification/), equipped with documentary audit credentials (Username: ESIGNACT · Password: ESIGN-UETA).
• b) PAdES Advanced Electronic Signatures and eIDAS Timestamping: Native digital documents integrate qualified cryptographic signatures conforming to the PAdES standard (PDF Advanced Electronic Signatures) and qualified electronic timestamps, in full conformity with Regulation (EU) No 910/2014 (eIDAS Regulation) and Article 1367 of the French Code civil.
• c) Strict Data Minimisation on Public QR Verification: QR code verification strictly confirms digital signature integrity and fundamental degree registration particulars (graduate name, unique matriculation code, degree title, academic level, and honors distinction), without publicly disclosing detailed individual grades from Annex B, individual clinical patient records from Annex A, or the graduate's private contact address.

ARTICLE 8 – Registral Consistency of the Dual Academic Track and Methodological Distinction between Anonymisation and Pseudonymisation in Research

I. – The academic registries maintained by the Central Academic Secretariat (scolarite@saejee.eu) reflect with mathematical and documentary exactitude the architecture of the Dual Academic Track (Article 5 of the General Terms and Conditions): 180 ECTS credits under the European Higher Education Area (EHEA) framework and 8,640 certified hours for Latin American (LATAM) and common-law credential evaluation standards, positioning the doctorate at Level 8 of the European Qualifications Framework (EQF Level 8).

II. – In the context of doctoral research (Annex C) and clinical practicums, research data is strictly managed under international PRISMA and ICH-GCP guidelines, ensuring clear distinction between technical pseudonymisation (retaining an encrypted key held under strict clinical separation) and definitive irreversible anonymisation, safeguarding human research participant privacy pursuant to Article 89 of the GDPR.

ARTICLE 9 – Legal Categorisation of Data Recipients, Technical Processors, and European Cloud Sovereignty

I. – The University rigorously delimits the legal status of all entities participating in data flows:

• 1° Authorized Internal Personnel under Confidentiality Undertakings: Rectoral authorities, Academic Secretariat officers, PRADA legal counsel, and faculty advisors bound by statutory confidentiality.
• 2° Technical Data Processors (Sous-traitants / Data Processors — Art. 28 GDPR): European technology infrastructure providers operating under binding Data Processing Agreements:
  • a) OVHcloud SAS: French corporate entity headquartered at 2 rue Kellermann, 59100 Roubaix, French Republic (RCS Lille Métropole 424 761 419), whose high-security European datacentres in Paris, Roubaix, and Gravelines host core institutional server infrastructure.
  • b) Hetzner Online GmbH: German corporate entity headquartered at Industriestr. 25, 91710 Gunzenhausen, Federal Republic of Germany, whose ISO/IEC 27001 certified datacentres in Gunzenhausen and Nuremberg provide geographic redundancy within the European Economic Area.
• 3° Joint Data Controllers in Interuniversity Cooperation (Joint Controllers — Art. 26 GDPR): In doctoral curricula (DIU-DOCTORAT) delivered under interinstitutional cooperation agreements pursuant to Article L. 718-16 of the Code de l'éducation — including academic cooperation with Helmstedt University (Germany) and clinical reference frameworks with Universitätsmedizin Berlin (Germany) —, exchanges of academic records are governed by joint controllership agreements ensuring uniform GDPR application on European soil.
• 4° Separate Third-Party Controllers (Separate Controllers): European notaries public, competent authorities executing Hague Apostille legalisations under the 1961 Hague Convention, foreign credential evaluation ministries, and certified payment providers (notably PayPal, under which the University operates under verified fiscal credentials SIREN 399 107 937 · VAT FR55399107937).

ARTICLE 10 – International Data Transfers Outside the European Economic Area (Schrems II Doctrine)

I. – Where transnational educational programmes, remote student or faculty access from Latin America (LATAM), or document submissions to third-country authorities entail cross-border data flows outside the European Economic Area (EEA), the University implements the safeguards mandated by Chapter V of the GDPR (Arts. 44 to 49):

• 1° Adequacy Decisions of the European Commission (Art. 45 GDPR): Applied by operation of law whenever the recipient is established in a jurisdiction recognized as providing an adequate level of data protection.
• 2° Standard Contractual Clauses (SCC) and Transfer Impact Assessments (TIA) (Art. 46.2.c GDPR): For third countries lacking an adequacy decision, routine exchanges with affiliated faculty or partner institutions are governed by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), coupled — in strict adherence to the CJEU's Schrems II ruling (Case C-311/18) — with Transfer Impact Assessments (TIA) and end-to-end cryptographic encryption (TLS 1.3 in transit, AES-256 at rest, Zero-Trust key management in France and Germany).
• 3° Contract Performance and Legal Rights in Credential Evaluation (Arts. 49.1.b and 49.1.e GDPR): Specific transmissions of academic transcripts or degree verifications requested by the student or graduate to their home country for the performance of their educational contract or for professional licensure and credential evaluation fall legitimately under the statutory derogations of Article 49, Paragraph 1, Points (b) and (e), of the GDPR.
• 4° Information Regarding Safeguards: Any data subject may obtain detailed information regarding the safeguards governing their data transfers by contacting the PRADA Legal Directorate (prada@universiteeuropeenne.paris).

ARTICLE 11 – Document Lifecycle Stratification and Dual Doctrine of Permanent Degree Archiving

I. – Pursuant to the principle of storage limitation (Art. 5.1.e GDPR), the institution structures personal data lifecycles across three (3) auditable phases:

• 1° Phase I — Operational Active Base (Base active): Retained for the active duration of the educational programme, accessible to faculty, instructional supervisors, and the Academic Secretariat.
• 2° Phase II — Intermediate and Restricted Historical Archive (Archivage intermédiaire et définitif restreint): Following graduation, records are migrated into an encrypted, isolated archive accessible exclusively to the Central Academic Secretariat and PRADA Legal Directorate for statutory tax compliance and perpetual degree authentication.
• 3° Phase III — Secure Destruction or Irreversible Anonymisation: Upon expiry of statutory retention limits for ancillary administrative data not part of official degree records, data is purged via secure cryptographic wiping algorithms or transformed into irreversibly anonymized statistical records.

II. – Dual Doctrine of Permanent Degree Archiving and Inviolability of the Academic Registry: The perpetual retention of matriculation registries, dissertation defense minutes, conferred degrees, and European Diploma Supplements (SET) finds its lawful basis in the convergence between the institutional legitimate interest in upholding public academic faith and preventing fraud (Art. 6.1.f GDPR), and the explicit statutory exceptions to the right to erasure set forth in Article 17, Paragraph 3, Points (b), (d), and (e), of the GDPR (compliance with statutory archiving obligations in the public interest, scientific/historical research archiving, and the establishment, exercise, or defense of legal claims and graduate credential rights). Consequently, while a graduate's exercise of the right to erasure permits deletion of ancillary marketing or navigation data, it leaves entirely intact and inalterable the master academic record of the conferred qualification (graduate name, unique matriculation number, degree title, graduation date, and cryptographic QR code), guaranteeing perpetual credential validity before public authorities and employers worldwide.

ARTICLE 12 – Statutory Document Retention Matrix

I. – Retention schedules applicable to each document category within the EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS) are established pursuant to the following binding schedule:

ARTICLE 13 – Catalogue of Data Subject Rights, Operational Procedure, and Right to Lodge Regulatory Complaints

I. – Every data subject whose personal data is processed by the University may exercise the rights conferred by Chapter III of the GDPR (Arts. 15 to 22) and the French Loi Informatique et Libertés:

• 1° Right of Access (Art. 15 GDPR): Obtain confirmation as to whether personal data concerning them is being processed, and receive a copy thereof.
• 2° Right to Rectification (Art. 16 GDPR): Obtain without undue delay the rectification of inaccurate personal data or completion of incomplete records.
• 3° Right to Erasure (Art. 17 GDPR): Request erasure of data where retention is no longer necessary, subject to statutory archiving exceptions for academic degrees (Art. 17.3 GDPR).
• 4° Right to Restriction of Processing (Art. 18 GDPR): Obtain restriction of processing where accuracy is contested or processing is unlawful.
• 5° Right to Data Portability (Art. 20 GDPR): Receive personal data provided to the institution in a structured, commonly used, and machine-readable format.
• 6° Right to Object (Art. 21 GDPR): Object on grounds relating to their particular situation to processing based on legitimate interests.

II. – Procedure for Exercising Rights and Regulatory Remedies:

• a) Dedicated Contact Channel: Requests may be submitted by email to dpd@universiteeuropeenne.paris or by postal mail addressed to: EUROPEAN UNIVERSITY OF PARIS – DPO Unit / PRADA Legal Office, 229 boulevard Voltaire, 75011 Paris, France.
• b) Identity Verification: To prevent unauthorized disclosure, requests must include valid proof of identity (passport or national ID card) and the applicant's matriculation reference.
• c) Statutory Response Deadline: The University responds within a maximum of one (1) month of receipt (extendable by two additional months in cases of complex requests, with reasoned notice provided within the initial month pursuant to Art. 12.3 GDPR).
• d) Right to Lodge Complaints: Without prejudice to internal conciliation procedures, data subjects hold the right under Article 77 of the GDPR to lodge a complaint with the competent supervisory authority in the French Republic (the Commission Nationale de l'Informatique et des Libertés — CNIL, located at 3 Place de Fontenoy, 75007 Paris, France) or with the supervisory authority of their habitual residence.

III. – Absence of Automated Individual Decision-Making (Art. 22 GDPR): It is formally certified that EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS) makes no decisions based solely on automated processing and employs no algorithmic profiling producing legal effects concerning student admission, grading, dissertation evaluation, or degree conferral. All academic and evaluative determinations result from collegial human assessment conducted by Admissions Committees, faculty mentors, and Academic Defense Boards.

ARTICLE 14 – Technical and Organisational Security Measures (Art. 32 GDPR) and Tracking Technology Governance (Art. 82 Law 78-17)

I. – Pursuant to Article 32 of the GDPR, the University deploys a comprehensive cybersecurity defence architecture:

• 1° Comprehensive Cryptographic Encryption: Transmission over TLS 1.3 protocols, encrypted storage at rest (AES-256), and PAdES / eIDAS electronic sealing across all official academic credentials and certificates.
• 2° Geographic Redundancy and Immutable European Backups: Automated and immutable backups hosted exclusively within the datacentres of OVHcloud SAS (France) and Hetzner Online GmbH (Germany).
• 3° Breach Notification Protocol (Arts. 33 & 34 GDPR): Continuous integrity monitoring and mandatory supervisory authority notification within seventy-two (72) hours for any data breach presenting risks to fundamental rights, complemented by Data Protection Impact Assessments (DPIA — Art. 35 GDPR) prior to deploying new technological instruments.

II. – Cookie Governance and Financial Guarantee Tracking (ePrivacy Directive & Article 82 of French Law No. 78-17):

• a) Technical and Strictly Necessary Cookies (Exempt from Consent): Essential devices ensuring browsing security, active LMS session maintenance, and cryptographic traceability of payment transactions conducted under the fiscal identity EUROPEAN UNIVERSITY OF PARIS (SIREN 399 107 937 · VAT FR55399107937), guaranteeing the operation of the Threefold Student Protection Guarantee (Article 10 of the General Terms and Conditions: 14-day European statutory withdrawal, 30-day extended institutional satisfaction guarantee, and 180-day PayPal Buyer Protection).
• b) Analytics and Personalisation Cookies (Subject to Prior Consent): Aggregated analytics and language preference cookies, activated only upon the user's prior informed consent via a symmetric consent banner allowing acceptance or refusal in one click without deceptive design patterns (dark patterns), in complete alignment with the Privacy Policy (PDF) and Legal Notice and Statutory Impressum (PDF).

ARTICLE 1 – Statutory Scope, Legal and Doctrinal Grounding, and Cardinal Principles of Confidentiality and Institutional Discretion

I. – This Policy on Confidentiality, Professional Secrecy, and Documentary Reserve (Institutional Repository Reference: REG-PRIV-SAEJEE-2026-v6.0) constitutes the internal regulatory instrument governing the duty of discretion, academic and expert professional privilege, confidentiality of institutional communications, and cryptographic portfolio security within the EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS). Expertly complementing the Personal Data Protection Charter (PDF), the Legal Notice and Statutory Impressum (PDF), and the General Terms and Conditions of Sale and Enrolment (PDF), this normative body establishes substantial guarantees of inviolability and confidentiality for information entrusted by applicants, third-cycle doctoral candidates, researchers, external board examiners, and international alumni.

II. – In exercise of its statutory autonomy and pursuant to Article 32 of Regulation (EU) 2016/679 (GDPR), the University conducts its operations under four (4) overarching cardinal principles:

• 1° Principle of Confidentiality and Registral Inviolability: Statutory guarantee that no academic dossier, doctoral research manuscript, examination board minutes, or financial record shall be disclosed, commercialised, or exposed to unauthorized third parties, preserving its cryptographic integrity throughout its operational lifecycle.
• 2° Principle of Lawful Custody and Purpose Limitation: All processing of confidential information answers strictly to higher education, doctoral scientific research, summative assessment, degree certification, and official credential verification purposes, with any incompatible secondary use formally prohibited.
• 3° Principle of Minimisation and Reserve in Public Verification (Art. 5.1.c GDPR): Strict delimitation between the open public validation tier (QR code confirmation restricted to authenticating conferred degree particulars) and the protected reserved analytical tier (Annexes A, B, and C), accessible only upon cryptographic authorization.
• 4° Principle of Transparency and Transnational Legal Certainty: Continuous and auditable access for students and researchers — across the European Union, Latin America (LATAM), and internationally — to the legal bases and technical protocols securing the privacy of their academic heritage.

ARTICLE 2 – Synoptic Table of Legal Personality, Official French Registries, and Confidentiality Oversight Bodies

I. – The custody of confidential records gathered on the institutional portal (www.universiteeuropeenne.paris), the Virtual Campus (LMS), and the secure verification platform (https://www.saejee.eu/verification/) is executed under the direct authority and responsibility of the French legal entity whose registration particulars and oversight bodies are detailed below:

ARTICLE 3 – Harmonisation of European Union Law and French Positive Law for the Benefit of International Students

I. – The confidentiality architecture of EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS) confers upon all students, doctoral candidates, and alumni — with particular resonance for professionals residing in Latin America (LATAM) and internationally — the highest level of legal protection in comparative law, subjecting academic records directly and unconditionally to European Community and French statutory standards:

• 1° Regulation (EU) 2016/679 (GDPR): Direct and supreme application regarding territorial scope (Art. 3), principles of integrity and confidentiality (Art. 5.1.f), lawful bases (Arts. 6 & 9), data subject rights (Arts. 12 to 22), cryptographic security (Arts. 24 to 39), cross-border transfers (Arts. 44 to 49), and scientific research and archiving exemptions (Art. 89).
• 2° French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files, and Civil Liberties (as amended): Statutory framework governing automated files, procedural safeguards before the Commission Nationale de l'Informatique et des Libertés (CNIL), and terminal device storage regulations (Art. 82).
• 3° Protection of Professional Secrecy and Intellectual Property under French Law: Complete integration with civil and ethical confidentiality doctrines and the intellectual property protection of original doctoral research under the French Code de la propriété intellectuelle (Arts. L. 111-1 et seq.).

ARTICLE 4 – Doctrinal and Legal Delimitation between French Educational Mandates and Data Processing Lawfulness

I. – The institution's legal capacity, pedagogical autonomy, execution of European interuniversity conventions, and conferral of Interuniversity Doctoral Degrees (DIU-DOCTORAT) and University Diplomas (DU) are anchored in the Code de l'éducation (Art. L. 151-1, Art. L. 613-2, Art. L. 731-1, Art. L. 444-1, Art. L. 444-8, Art. L. 718-16, and Art. L. 123-3) and the Code de la recherche (Art. L. 412-1).

II. – Pursuant to the principle of normative specialty, these educational and scientific statutes consolidate the institutional legitimacy of the University within the French Republic, whereas every processing operation involving personal data is independently and strictly grounded upon Articles 6 and 9 of the GDPR, ensuring dual compliance — academic and privacy — before any national or international audit.

ARTICLE 5 – Cross-Cutting Operational Confidentiality Mapping across Seven Phases of Higher Education and Certification

I. – Pursuant to Article 12 of the GDPR, the University establishes the specific confidentiality protocols governing each of the seven (7) operational domains of its higher education ecosystem:

ARTICLE 6 – Weighting of Lawful Bases and Consequences of Mandatory Document Provision

I. – The confidentiality and legitimacy of the operational domains described in Article 5 rest upon four (4) specific legal bases under Article 6.1 of the GDPR:

• 1° Performance of the Educational Contract (Art. 6.1.b GDPR): Covers admissions, matriculation, instruction, dissertation advisement, and credential conferral.
• 2° Compliance with Legal Obligations (Art. 6.1.c GDPR): Covers tax and accounting compliance under French law and mandatory administrative disclosure to judicial authorities.
• 3° Legitimate Institutional Interest in Public Academic Probity (Art. 6.1.f GDPR): Covers anti-fraud credential validation via QR code and cybersecurity defense.
• 4° Explicit Consent for Specific Services (Art. 6.1.a GDPR): Covers non-essential website cookies and optional alumni association communications.

II. – Provision of academic and identification records is mandatory for matriculation. Refusal to provide verified credentials precludes completion of the enrolment contract and prevents credential conferral.

ARTICLE 7 – Categorical Separation between Student Academic Records and Third-Party Clinical, Neuropsychological, or Forensic Files (Logbook)

I. – In postgraduate and doctoral curricula involving health sciences, criminal psychology, clinical neuropsychology, forensic psychiatry, neuropunishment, and legal and criminalistic sciences, the University establishes an airtight technical and legal partition between the student's academic record and third-party sensitive data examined during supervised practicums:

• 1° Absolute Separation of Servers and Registries: The student's academic dossier (identity records, matriculation number, examination grades, and defense minutes) is conserved in the central registry of the Academic Secretariat. Conversely, medical files, psychodiagnostic protocols, forensic evaluations, victim depositions, or criminal records examined by the candidate within hospital, clinical, or judicial settings are never ingested in raw format nor with third-party personal data into University servers or student academic portfolios.
• 2° Joint Application of Articles 6, 9, and 10 of the GDPR in Research Activities: Any research or expert practicum involving health data (Art. 9 GDPR) or criminal convictions and offences (Art. 10 GDPR) is subject within the host institution to explicit consent (Art. 9.2.a GDPR) or statutory scientific research exemptions (Art. 9.2.j & Art. 89.1 GDPR), duly approved by the competent ethics board or judicial authority.
• 3° Non-Extraction Undertaking: Status as a student, faculty member, or researcher at the EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS) strictly prohibits the extraction, duplication, or dissemination of third-party personal data outside the clinical or judicial facilities where the practicum is conducted.

ARTICLE 8 – International Scientific Protocols (PRISMA / ICH-GCP), Source Anonymisation, and Perpetual Duty of Professional Secrecy

I. – For the validation of supervised practicum logbooks (Annex A) and doctoral dissertations (Annex C) pursuant to Article 89 of the GDPR and Article L. 412-1 of the Code de la recherche (PDF), strict adherence to the following three (3) methodological safeguards is mandatory:

• 1° Irreversible Source Anonymisation in Fieldwork: Prior to recording clinical cases or forensic interventions in the Logbook (Annex A) or dissertation (Annex C), candidates must apply complete de-identification techniques, ensuring that only irreversibly anonymized clinical, statistical, or legal variables are processed.
• 2° International Methodological Rigour (PRISMA and ICH-GCP): Systematic reviews, meta-analyses, and clinical trials adhere to PRISMA guidelines (Preferred Reporting Items for Systematic Reviews and Meta-Analyses), ICH-GCP Good Clinical Practice standards, and the ethical principles of the Declaration of Helsinki.
• 3° Perpetual Duty of Professional Secrecy: Faculty members, dissertation advisors, board examiners, administrative staff, and matriculated students are bound by an unconditional duty of professional secrecy regarding confidential or expert information acquired in their university capacity, an obligation subsisting in perpetuity even after cessation of their institutional affiliation.

ARTICLE 9 – Physical and Digital Custody of Academic Minutes, QR Platform Minimisation, and Auditable Consultation Logs

I. – Original degree collation registers, doctoral defense minutes, and matriculation registries are conserved at the statutory head office in Paris through a dual preservation protocol:

• 1° Secure Physical Archiving at Registered Seat: Master paper records bearing wet signatures and embossed dry seals (gaufrage à sec) are archived within fireproof security vaults at 229 Boulevard Voltaire, 75011 Paris, accessible exclusively to the Rectorate and Central Academic Secretariat.
• 2° Encrypted Digital Archiving with EU Redundancy: Master digital records conforming to the PAdES standard are protected by robust AES-256 encryption and stored in georedundant ISO/IEC 27001 certified datacentres in France and Germany. Access to an alumnus's record requires: a) express written authorization from the graduate; or b) a lawful judicial or notarial requisition.

II. – The official verification platform (https://www.saejee.eu/verification/) balances public credential validation with privacy through three (3) technical protocols:

• a) Strictly Delimited Public Response: Scanning the QR code on the Degree Parchment or Diploma Supplement returns only the essential metadata necessary to confirm degree authenticity (graduate name, unique matriculation number, official degree title, conferral date, honors, and PAdES digital signature validity).
• b) Absolute Confidentiality of Detailed Annexes: Pursuant to data minimisation (Art. 5.1.c GDPR), public QR lookup never exposes identity documents, personal addresses, detailed course-by-course grades from Annex B, or clinical records from Annex A. Full verification requires authorized credentials (ESIGNACT / ESIGN-UETA) provided directly by the graduate to the evaluating authority.
• c) Anti-Fraud Audit Logging: Every query generates an auditable security log (querying IP address, certified timestamp, queried certificate identifier) exclusively to guarantee forensic traceability and prevent fraudulent document tampering.

ARTICLE 10 – Technical and Legal Delimitation Matrix between International Authentication Instruments and GDPR Cybersecurity Measures

I. – To provide clarity for evaluation committees and legal auditors, the University establishes the functional distinction between physical document authentication features (applied to solemn A3 format — 420 × 297 mm parchments featuring embossed dry seals and optical variable holograms) and logical cybersecurity measures under Article 32 of the GDPR:

ARTICLE 11 – Data Processing Agreements (Art. 28 GDPR), European Infrastructure Sovereignty, and Joint Responsibility Protocols

I. – The chain of confidentiality binding technology vendors and institutional partners is governed by the following instruments:

• 1° Binding Data Processing Agreements (Art. 28 GDPR): Mandatory execution of written agreements with all technical processors (OVHcloud, Hetzner Online, payment processors) prohibiting secondary data usage and mandating ISO/IEC 27001 security standards.
• 2° Joint Controllership Agreements (Art. 26 GDPR): Academic cooperation conventions executed pursuant to Article L. 718-16 of the Code de l'éducation — including interinstitutional cooperation with Helmstedt University (Germany) and clinical reference frameworks with Universitätsmedizin Berlin (Germany) — incorporate transparent joint controller arrangements defining GDPR compliance duties across European borders.

ARTICLE 12 – International Data Transfers, Schrems II Safeguards, and Permanent Archival Inviolability

I. – In accordance with Chapter V of the GDPR (Arts. 44 to 49) and the CJEU's Schrems II doctrine, international data transfers to students, faculty, or authorities in Latin America and third countries are executed under European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021/914) reinforced by end-to-end encryption (TLS 1.3 in transit, AES-256 at rest) and statutory contract performance derogations (Art. 49.1.b & e GDPR).

II. – Master graduation registries, doctoral dissertation defense records, and conferred degree credentials are preserved permanently in the Historical Registry pursuant to Article 17.3 of the GDPR, ensuring lifelong credential verification for alumni worldwide.

ARTICLE 13 – Five-Stage Operational Protocol for Cybersecurity Incidents and Supervisory Notification (Arts. 33 & 34 GDPR)

I. – Pursuant to Articles 33 and 34 of the GDPR, the University deploys a five-stage incident response protocol:

• 1° Stage 1 — Immediate Detection and Containment (0 to 12 Hours): Real-time intrusion detection, server isolation, and activation of the Computer Emergency Response Team (CERT).
• 2° Stage 2 — Impact Assessment and Severity Classification (12 to 36 Hours): Evaluating risks to data subject rights, assessing data volume, and determining potential confidentiality harm.
• 3° Stage 3 — CNIL Supervisory Authority Notification (Within 72 Hours): Mandatory notification to the French Data Protection Authority (CNIL) pursuant to Article 33 of the GDPR if risk is established.
• 4° Stage 4 — Communication to Affected Data Subjects (Art. 34 GDPR): Direct notification to affected individuals without undue delay if the breach entails a high risk to fundamental rights.
• 5° Stage 5 — Security Incident Log Recording (Art. 33.5 GDPR): Comprehensive documentation of facts, effects, and remedial actions in the institutional Security Incident Register.

ARTICLE 14 – Technical Cookie Matrix, Communications Segregation, and Statutory Seal of Entry into Force

I. – In application of Article 82 of the French Loi Informatique et Libertés and CNIL deliberations, digital trackers within the University's digital ecosystem are governed by the following schedule:

II. – Strict Segregation between Administrative and Informational Communications:

• a) Mandatory Academic and Administrative Notices (Art. 6.1.b GDPR): Enrolment confirmations, examination schedules, dissertation defense notices, and credential conferral advisories are issued exclusively from official domain addresses: @universiteeuropeenne.paris and @saejee.eu.
• b) Informational Communications (Art. 6.1.a GDPR): Sent exclusively to individuals who have expressly opted in, with every message incorporating an immediate, cost-free, automated unsubscribe link (opt-out).

III. – Validity and Institutional Deposit: This Policy on Confidentiality, Professional Secrecy, and Documentary Reserve (Consolidated Version v6.0 — 2026 · Institutional Deposit Reference: REG-PRIV-SAEJEE-2026-v6.0), enacted by the Rectorate of the EUROPEAN UNIVERSITY OF PARIS (SAEJEE — UNIVERSITÉ EUROPÉENNE DE PARIS) under the signature of Prof. Dr. Ramón L. Maiha Mulleras in Paris (229 Boulevard Voltaire, 75011 Paris, French Republic), is fully in force and operates in complete harmony with the Legal Notice and Statutory Impressum, the General Terms and Conditions of Sale and Enrolment, and the Personal Data Protection Charter.