Privacy Policy

Version 1.0 — draftEffective date 30 September 2026

This English text is a translation provided for information only. The French version is the only one that is authoritative.

Publisher: Edixos — a French société par actions simplifiée unipersonnelle with a share capital of EUR 1,000, registered with the Pontoise Trade and Companies Register under number 921 321 600, whose registered office is at 17 boulevard Charles de Gaulle, 95110 Sannois, France Service: the Klastro platform (klastro.io, app.klastro.io) Version: 1.0 — draft Effective date: 30 September 2026

This policy is issued under Articles 12, 13 and 14 of Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended (the "French Data Protection Act").

Note on language and applicable law. Edixos is established in France. Certain obligations described in this policy arise from French statutes that have no direct equivalent in other legal systems — in particular the French Data Protection Act (which implements the ePrivacy Directive), Article L123-22 of the French Commercial Code (accounting record retention) and Articles L1221-6, L1221-8 and L1221-9 of the French Labour Code (candidate information in recruitment). These references are retained in this English version rather than translated into a functional equivalent, because the underlying obligation is French and applies regardless of the language in which this policy is read. The GDPR applies identically to both language versions. This English version is a translation for convenience; the French version prevails in the event of a discrepancy.

1. Identity and contact details of the controller

Art. 13(1)(a) GDPR

Edixos is established in the European Union. No representative under Article 27 GDPR is therefore required.

2. Scope and allocation of roles

Klastro is operated under two distinct commercial models. Edixos's capacity under Article 4 GDPR differs between them, and that distinction determines who a data subject must address a request to.

2.1 Subscription offering (learners and instructors — "B2C")

For accounts taken out directly by an individual, or by an organisation for its own training needs, Edixos determines the purposes and means of processing. Edixos acts as controller within the meaning of Article 4(7) GDPR. This policy applies in full and directly.

2.2 Contract assessment offering (recruiters and candidates — "B2B")

Where a business customer uses Klastro to assess candidates as part of a recruitment process, that business customer is the controller and Edixos acts as processor within the meaning of Article 4(8) GDPR. Edixos then processes candidate data only on the customer's documented instructions, under the data processing agreement concluded pursuant to Article 28 GDPR (see en/02-data-privacy/b2b-dpa-template.md).

In that configuration:

• the candidate must address data subject rights requests (Arts. 15 to 22 GDPR) to the recruiting customer, which is the competent recipient; Edixos forwards to that customer any request received directly and assists it in handling the request;
• the duty to inform the candidate under Articles 13 and 14 GDPR rests with the recruiting customer; Edixos makes a template notice available (see en/04-compliance-hr/candidate-privacy-notice.md), without that provision transferring the corresponding responsibility.

Sections 5 (recipients), 6 (transfers) and 8 (security) describe technical facts common to both models and remain relevant in either case.

3. Categories of personal data processed

Arts. 13(1) and 14(1)(d) GDPR

No special category of data within the meaning of Article 9(1) GDPR is intentionally collected. As regards the video stream at 3.6, Edixos performs no specific technical processing for the purpose of uniquely identifying a natural person; that stream therefore does not constitute biometric data within the meaning of Article 4(14) GDPR. It nonetheless remains sensitive in practice, and its lawfulness is a matter for the recruiting customer (see section 4.3).

Source of the data. The data at 3.1 to 3.8 is, as the case may be, provided directly by the data subject, generated by their use of the service, or — for candidates invited by a recruiting customer — transmitted to Edixos by that customer (Art. 14(2)(f) GDPR).

Scope and fate of data produced inside the lab environment (3.4). The lab environment is an isolated execution space — a dedicated Kubernetes namespace, a virtual machine or an ephemeral cluster — provisioned for the duration of the session only. Edixos does not inspect or index its contents. Everything the User produces in it (files, commands, terminal output, resources created) resides exclusively within that environment and is destroyed with it when the session ends or its configured time-to-live expires, with no backup and no archiving. Only execution metadata — timestamps, session identifier, Lab Credit consumption, task validation results — is kept outside the environment, for the periods set out in section 8.

Consequence for the User. Because this data is neither backed up, nor inspectable, nor recoverable once the session is destroyed, introducing third-party personal data, production secrets or third-party confidential information into a lab environment is contractually prohibited (Terms of Use, Article 8.3). Edixos can exercise no right over, and answer no request concerning, data it cannot locate and that disappears with the session.

4. Purposes and legal bases

Arts. 13(1)(c) and 6(1) GDPR

4.2 Legitimate interests balancing exercise (Art. 6(1)(f) GDPR, Recital 47)

In accordance with Article 6(1)(f) GDPR, Edixos has carried out the following balancing exercise for security logging and fraud prevention:

1. Interest pursued. Safeguarding the integrity and availability of a platform that executes user-supplied code in dedicated compute environments; detecting abuse (circumvention of credit metering, unauthorised access attempts, misappropriation of compute resources); and being able to reconstruct a sequence of events following a security incident, which Article 32(1)(b) and (d) GDPR independently requires.
2. Necessity. Logs are limited to security and lifecycle events; they do not record the substance of a user's work; they rely on technical user and organisation identifiers rather than direct identifiers wherever possible; and their retention is capped at twelve months with an automated daily purge. No less intrusive means would achieve the same result.
3. Balance. A user of an infrastructure platform reasonably expects administrative actions to be logged; the logs are used neither for commercial profiling nor for automated individual decision-making; they contain no sensitive data. The right to object under Article 21(1) GDPR remains open, it being noted that Edixos may need to demonstrate compelling legitimate grounds relating to the security of the service.

The record of this balancing exercise is available on request at the address in section 1.

4.3 Proctoring — clarification on the legal basis

Where a recruiting customer enables webcam capture during an assessment, Edixos acts as processor and establishes no legal basis of its own. It falls to the recruiting customer, as controller:

• to hold a valid legal basis under Article 6(1) GDPR — candidate consent being in practice the only basis that can be reliably relied upon in a recruitment context;
• to inform the candidate, before the assessment, of the assessment methods and techniques used, in accordance with Articles L1221-8 and L1221-9 of the French Labour Code, no method not previously brought to the candidate's knowledge being permitted;
• to assess whether a data protection impact assessment is required under Article 35 GDPR, systematic monitoring of candidates being among the criteria set out in the EDPB-endorsed DPIA guidelines (WP248 rev.01, endorsed by the EDPB on 25 May 2018).

Edixos will refuse any instruction that appears to it manifestly to infringe the GDPR and will inform the customer accordingly, in accordance with the second subparagraph of Article 28(3) GDPR.

5. Recipients and sub-processors

Art. 13(1)(e) GDPR

Data is never sold, rented or transferred to third parties for marketing purposes.

5.1 Internal recipients

Only Edixos personnel with a need to know access the data, within the limits of their duties, and are bound by a confidentiality undertaking.

5.2 Recipients within a customer organisation

Administrators and, where applicable, instructors or supervisors of a customer organisation have access to the usage, progress and assessment data of that organisation's members, within the scope defined by the permissions the customer has configured.

5.3 Sub-processors

Clarification. The identity and authorisation components used by Klastro (Ory Kratos and Ory Keto) are self-hosted by Edixos on its own infrastructure. They are not sub-processors: user credentials are not passed to any third-party identity provider.

Support tool (section 3.8). The helpdesk (Zammad, support.klastro.io) is self-hosted by Edixos on its own infrastructure. It is not a sub-processor: the content of support requests is passed to no third-party vendor.

5.4 Authorities

Data may be disclosed to administrative or judicial authorities where the law so requires. Edixos will then notify the data subject or the customer controller, unless legally prohibited from doing so.

6. Transfers outside the European Union

Chapter V GDPR (Arts. 44 to 49)

All data processed for the operation of the platform is hosted and processed in Scaleway's fr-par region (Paris, France). No customer, learner or candidate data is transferred outside the European Union in connection with the hosting and operation of the service.

Payment chain — verified 2026-09-20. Billing data is processed by Stripe Payments Europe, Limited (Ireland) and is transferred to Stripe, Inc. in the United States. The statement above concerning EU hosting therefore covers platform hosting; the payment chain relies on the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) together with Stripe's EU–U.S. Data Privacy Framework certification (Commission Implementing Decision (EU) 2023/1795). Any public statement of EU data residency must carry the same scope.

7. Retention periods

Arts. 13(2)(a) and 5(1)(e) GDPR

Backups. Irrespective of the periods above, data may persist in encrypted backups for up to 33 days after its deletion from live systems (the backup retention cycle, deliberately longer than the 30-day object lock that protects them against alteration) (see section 9.4).

8. Security of processing

Art. 32 GDPR

The following technical and organisational measures are actually implemented as at the date of this policy:

8.1 Encryption (Art. 32(1)(a) GDPR)

• Communications encrypted in transit using TLS 1.3, with TLS termination performed by the Envoy Gateway.
• Encryption at rest of the PostgreSQL database through Scaleway Block Storage encryption.
• Server-side encryption of backups held in S3 object storage.

8.2 Authentication and access control

• Authentication provided by an Ory Kratos instance self-hosted by Edixos; credentials are not entrusted to any third-party identity provider.
• Session cookies carry the HttpOnly, Secure and SameSite=Lax attributes; session lifetime is limited to 24 hours.
• Authorisation provided by Ory Keto on a deny-by-default relationship-based access control model, evaluated on every API request. The mechanism is fail-closed: an error from the authorisation service results in the request being denied, never allowed.
• Secrets managed by the Kubernetes External Secrets Operator with generated passwords; no secret is committed to source control.
• A separate SSH key pair is generated for each session (RSA 2048-bit, cryptographically random, PKCS8 format) and is not reused across sessions.

8.3 Separation of execution environments

• Each lab session is provisioned in a dedicated Kubernetes namespace (klastro-session-{hash}) with dedicated compute resources: either an isolated virtual cluster (vcluster) or a dedicated virtual machine.

8.4 Logging and traceability (Art. 32(1)(b) and (d) GDPR)

• Synchronous database writes of security and lifecycle events, retained for 12 months and then purged by a daily job.
• Audit trail export in CSV format on request by an organisation administrator.

8.5 Resilience and backups (Art. 32(1)(b) and (c) GDPR)

• PostgreSQL backups managed by CloudNativePG with point-in-time recovery via barman, targeting an S3 bucket in the fr-par region.
• Backups are placed under a 30-day GOVERNANCE object lock: they are immutable for that period, which protects them against alteration and deletion, including in the event of a compromise.

8.6 Rate limiting

• Applied to sensitive endpoints: 10 requests per minute per IP address on invitation token lookup; 100 requests per minute per user on the general API.

8.7 Location

• Processing and hosting exclusively in the fr-par region (Paris, France).

In accordance with Article 32(1) GDPR, these measures are assessed against the state of the art, the cost of implementation and the risks involved, and may evolve. The list above describes the dispositif as actually deployed and deliberately excludes any measure that is merely planned or in progress.

9. Data subject rights

Arts. 15 to 22 GDPR

9.1 Rights available

• Right of access — Art. 15 GDPR: obtain confirmation that data concerning you is processed, and a copy of it.
• Right to rectification — Art. 16 GDPR: have inaccurate or incomplete data corrected. Profile data can be edited directly from account settings.
• Right to erasure — Art. 17 GDPR: see the clarification at section 9.4.
• Right to restriction of processing — Art. 18 GDPR.
• Right to data portability — Art. 20 GDPR: receive the data you have provided in a structured, commonly used, machine-readable format, for processing based on consent or on contract. An organisation's audit trail is exportable as CSV by its administrator.
• Right to object — Art. 21 GDPR: object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (section 4.2); an unconditional right to object applies to direct marketing.
• Right to withdraw consent — Art. 7(3) GDPR: at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Post-mortem directives — Art. 85 of the French Data Protection Act: set directives on the fate of your data after your death. This right has no equivalent in most other legal systems and arises from French law.

9.2 How to exercise them

Requests are addressed to [email protected]. Edixos responds within one month of receipt, extendable by two further months where necessary taking into account the complexity and number of requests, the data subject being informed of the extension and its reasons within one month of receipt (Art. 12(3) GDPR). Exercising these rights is free of charge (Art. 12(5) GDPR).

Edixos may request proof of identity where there are reasonable doubts as to the identity of the requester (Art. 12(6) GDPR).

9.3 Candidates assessed on behalf of a recruiting customer

As stated at section 2.2, Edixos then acts as processor. The request must be addressed to the recruiting customer. Any request received directly is forwarded to that customer without delay, and Edixos does not act on it of its own motion.

9.4 Important clarification on the right to erasure (Art. 17 GDPR)

Edixos applies the following policy, which faithfully reflects the technical architecture of the service:

1. Live systems: the data concerned is erased from production systems within a maximum of 30 days of a valid request or of account closure.
2. Backups: database backups are held under a 30-day GOVERNANCE object lock. Data present in an existing backup snapshot cannot be manually deleted from that medium before the lock expires. It ages out of backups completely within 33 days after its erasure from live systems, through expiry of the retention cycle.
3. During that residual period, data held in backups is used for no purpose whatsoever: it is accessible only for disaster recovery, and any restore is followed by re-application of the deletion.
4. Data that cannot be erased: data whose retention is required by a legal obligation — in particular accounting records under Article L123-22 of the French Commercial Code — is retained until the end of the statutory period, in accordance with Article 17(3)(b) GDPR.

This immutability measure is a security safeguard within the meaning of Article 32(1)(b) and (c) GDPR: it protects all users' data against malicious deletion or alteration.

9.5 Complaint to the supervisory authority

Arts. 13(2)(d) and 77 GDPR. Every data subject has the right to lodge a complaint with the French data protection authority (CNIL):

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr

Data subjects resident in another EU Member State may also lodge a complaint with their own national supervisory authority.

10. Automated individual decision-making and profiling

Art. 22 GDPR

The platform automatically evaluates work carried out in a lab environment and produces a score. That score is a measurement result, not a decision.

Edixos takes no decision producing legal effects concerning a person or similarly significantly affecting them that is based solely on automated processing within the meaning of Article 22(1) GDPR. In the B2B model, the score is made available to the recruiting customer, which is responsible for taking — with human involvement — any decision on the application. It is for that customer to comply with Article 22 GDPR in its own decision-making process.

Obligations arising under Regulation (EU) 2024/1689 (the AI Act) are addressed in a separate document: en/04-compliance-hr/eu-ai-act-disclosure.md.

11. Cookies and trackers

The setting and reading of trackers on a user's terminal is governed by Article 82 of the French Data Protection Act, which transposes Article 5(3) of Directive 2002/58/EC. These arrangements are described in the Cookie Policy: en/02-data-privacy/cookie-policy.md.

12. Minors

The service is not intended for persons under 15. No account may be created by a person below that age without the authorisation of the holder of parental responsibility, in accordance with Article 8 GDPR and Article 45 of the French Data Protection Act. Note: France has set the digital consent age at 15; other Member States have set it between 13 and 16 under Article 8(1) GDPR, so the applicable threshold may differ for users resident elsewhere in the EU.

Age verification. Edixos performs no technical age check at sign-up: no date of birth is requested or collected. The provision above therefore operates as a contractual undertaking by the User and not as a technical verification measure. That choice follows from the minimisation principle in Article 5(1)(c) GDPR — collecting a date of birth in order to check age would mean processing an additional item about every user so as to exclude a marginal fraction of them, the Platform being addressed to a professional and higher-education audience.

Where Edixos is informed that an account has been created by a person below the applicable age without the required authorisation, it deletes the account and the associated data without undue delay, in accordance with Article 17(1)(f) GDPR. Any such report may be sent to [email protected].

13. Changes to this policy

Edixos may amend this policy. Any material change is notified to users by email or by in-application notice, with reasonable advance notice before it takes effect. The version in force is the one published at https://app.klastro.io/legal/privacy, dated at the head of the document.

14. Contact

For any question about this policy or to exercise your rights: [email protected], or by post to Edixos's registered office, 17 boulevard Charles de Gaulle, 95110 Sannois, France.

Warning — draft document. Every value left open by version 0.1 was settled on 20 September 2026: publisher identity (verified against INSEE SIRENE, INPI and the VIES system), status of the data protection correspondent, Stripe contracting entity and transfer basis, hosting model for LiveKit and the support tool, retention periods for dormant accounts and support data, and the scope of lab data. The document remains subject to external counsel review before publication, in particular as to the analysis finding no obligation to designate a Data Protection Officer (section 1) and as to whether an Article 35 GDPR data protection impact assessment is required for candidate assessment processing.

Related documents: sub-processor list (en/02-data-privacy/subprocessor-list.md), technical and organisational measures (en/02-data-privacy/technical-organisational-measures.md), data retention policy (en/02-data-privacy/data-retention-policy.md), legal notice (en/01-terms-and-conditions/legal-notice.md).