Who we are
Our website address is: https://elsa-france.org.
This website is operated by ELSA France (English Language Schools Association), 86 rue de la Tour, 75116 Paris, France (SIRET 431 262 294 00025). ELSA France is the controller of the personal data described in this policy. You can contact us with any questions.
What personal data we collect and why
Contact form
When you use the contact form on our Contact page, we collect your first name, last name, email address, telephone number, the subject you choose and your message. We use this information to reply to your enquiry. The message is sent by email through our contact form. We do not store contact form submissions in the website database.
Membership requests
Membership requests are made through a Google Form linked from our Become a Member page. The form asks for details about your school (name, address, website, institution type, curriculum, diplomas offered and similar information) and the names and email addresses of the Head of School and the Head of Anglophone Section. We use this information so that the ELSA Board can review the request and, if it is accepted, manage the membership. Responses are collected in a Google Sheet in ELSA France's Google Workspace account.
Poetry by Heart registration
Schools register for the Poetry by Heart competitions through a Google Form linked from the Poetry by Heart page. The form asks for the name and email address of the school's contact person. We use this information to register the school and to issue the invoice for its entry. We do not collect any information about students through this form.
Event bookings
Bookings for ELSA events are made through Bookeo, an online booking service embedded in our Event Registration page. When you make a booking, the information you enter (such as your name and email address) is collected by Bookeo on our behalf. We use this information to confirm your booking and to organise the event.
Security logs
To protect the website, our security software records security-related events such as failed login attempts and blocked requests. These records include your IP address and browser user agent string. Our site administration log also records failed login attempts, including the IP address. We use this information to keep the website secure. It is kept for up to 60 days.
Cookies
We do not use analytics or advertising cookies on this website.
Our hosting platform sets two technical cookies, WEBMO-MNO and WEBMO-VNU, which are needed for the website to be delivered correctly. They are deleted when you close your browser.
If you use the contact form, Google reCAPTCHA is loaded on the Contact page to protect the form against spam. It sets a cookie called _GRECAPTCHA and sends information about your browser and device, including your IP address, to Google.
If you visit our Event Registration page, the Bookeo booking service sets a session cookie called AXIOMID. It is deleted when you close your browser.
If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When a website administrator logs in, we also set up several cookies to save their login information and screen display choices. Login cookies last for two days, and screen options cookies last for a year. If they select "Remember Me", the login will persist for two weeks. If they log out, the login cookies will be removed. If an administrator edits or publishes an article, an additional cookie will be saved in their browser. This cookie includes no personal data and simply indicates the post ID of the article they just edited. It expires after 1 day.
Embedded content from other websites
Pages on this site may include embedded content (for example, our event booking service from Bookeo, or links to forms hosted by Google). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Who we share your data with
We do not sell your personal data. We share it only with the following service providers, who process it on our behalf:
- Nuxit (Groupe Celeste), which hosts this website in France and handles email for the elsa-france.org domain, including messages sent through the contact form.
- Google, which provides Google Forms and Google Sheets for membership requests and Poetry by Heart registrations, and Google reCAPTCHA for the contact form.
- Bookeo, which handles event bookings.
Members of the ELSA Board and the volunteers who manage membership requests and events can see the information you send us, as far as they need it for their role.
If you request a password reset on the administration area of this site, your IP address will be included in the reset email.
How long we retain your data
- Contact form messages: 10 years.
- Membership requests: 10 years. Details of schools that become members are kept for as long as the membership lasts.
- Poetry by Heart registrations: 10 years.
- Event bookings: 10 years.
- Security logs: up to 60 days.
What rights you have over your data
You have the right to access the personal data we hold about you and to ask us to correct it, erase it, restrict how we use it, or to object to its use. Where we process your data on the basis of your consent, you can withdraw that consent at any time. You can also ask for an exported file of the personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
To use any of these rights, contact us.
If you believe your rights have not been respected, you can make a complaint to the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority, at https://www.cnil.fr.
Where your data is sent
This website is hosted in France. Some of our service providers, in particular Google, may process data outside the European Economic Area. Google LLC participates in the EU-U.S. Data Privacy Framework and, where applicable, relies on standard contractual clauses for transfers of personal data outside the European Economic Area.
Legal basis
We process contact form messages and security logs because we have a legitimate interest in answering enquiries and keeping our website secure. We process membership requests, Poetry by Heart registrations and event bookings so that we can take the steps you ask for before and when entering a membership or booking.
Last updated: October 2026.