PRIVACY POLICY

WHO WE ARE

This privacy policy applies to ConceptCore Academy, a French simplified joint-stock company (SAS) registered in Paris, France. We operate the website at conceptcore.academy and run a concept art education program out of Paris.

We are the data controller for the personal data collected through this website and our application process. If you have any questions about this policy or how we handle your data, you can reach us at academy@conceptcore.co.

WHAT WE COLLECT

We only collect data we actually need. Here is what comes through our systems:

// Application data

When you submit an application through our Notion-hosted form, we collect your name, email, country, portfolio links, written answers about your background and goals, and any uploaded files (such as PDF portfolios). This is the most detailed data we hold and it stays in our private Notion workspace.

// Scheduling data

If you book a consultation call through Acuity Scheduling, we receive your name, email, time zone, and any notes you add to the booking. Acuity processes this on our behalf.

// Mailing list

If you sign up to our mailing list, we store your email address and the date you subscribed. You can unsubscribe at any time using the link in any email we send you.

// Analytics and tracking

We use Google Tag Manager and Google Analytics to understand how visitors use the site. This includes pages viewed, time on page, country, device type, and referral source. We do not collect your IP address in a way that personally identifies you, and analytics data is anonymised before it reaches our reports.

// Cookies

The site uses a small number of cookies. Some are essential (they keep the site working). Others are analytics cookies (set by Google) and, if you opt in, marketing cookies. You can refuse non-essential cookies through your browser settings or our consent banner.

WHY WE COLLECT IT

Each piece of data has a specific purpose:

• Application data is used to review your application, decide whether to invite you for an interview, and ultimately whether to offer you a place in the program.
• Scheduling data is used to confirm your call, send reminders, and prepare for the conversation.
• Mailing list data is used to send you updates about the program, application deadlines, and events. You only hear from us if you have actively opted in.
• Analytics data is used to improve the website, understand which pages are useful, and decide where to focus our efforts.

LEGAL BASIS

Under the GDPR, every use of personal data needs a legal basis. Ours are:

• Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.
• Contract performance — for processing applications, organising calls, and delivering the program once you enrol.
• Legitimate interest — for understanding website usage at an aggregate level and protecting the site from abuse.

HOW LONG WE KEEP IT

We do not keep data longer than we need to.

• Applications from students who enrol: kept for 5 years after the program ends, for academic record-keeping and alumni communication.
• Applications from candidates who do not enrol: kept for 1 year, then deleted. This gives us time to follow up if a place opens or if you reapply.
• Mailing list: kept until you unsubscribe.
• Analytics data: retained for 14 months in Google Analytics, then automatically deleted.
• Scheduling data: kept for 2 years after the call, then deleted.

YOUR RIGHTS

Under the GDPR, you have several rights regarding your personal data, and we take them seriously:

• Right of access — you can ask for a copy of the data we hold about you.
• Right of rectification — you can ask us to correct anything that is wrong or out of date.
• Right of erasure — you can ask us to delete your data, subject to any legal obligations we have to keep it.
• Right to data portability — you can ask for your data in a machine-readable format so you can move it elsewhere.
• Right to object — you can object to processing based on legitimate interest, or to direct marketing.
• Right to withdraw consent — you can withdraw consent at any time without affecting processing that already happened.

To exercise any of these rights, email us at academy@conceptcore.co. We will respond within 30 days.

If you are not happy with how we handle your request, you also have the right to lodge a complaint with the CNIL, the French data protection authority, at cnil.fr.

WHO WE SHARE IT WITH

We do not sell your data. We share it only with the third-party processors we need to run the school:

• Notion Labs Inc. — hosts our application form and internal admissions database.
• Acuity Scheduling (Squarespace, Inc.) — handles consultation bookings.
• Google LLC — provides Tag Manager and Analytics.
• Cloudflare, Inc. — hosts our website and provides security and content delivery.

Some of these providers are based in the United States. When data is transferred outside the European Economic Area, it is covered by Standard Contractual Clauses or equivalent safeguards approved by the European Commission.

SECURITY

We protect your data with reasonable technical and organisational measures: encrypted connections, access controls on our internal systems, and limiting access to the small team that actually needs it. No system is perfect, but we treat your data the way we would want our own treated.

CHANGES TO THIS POLICY

If we update this policy, we will change the date at the top of the page and, for material changes, notify subscribers by email. The current version always lives at this URL.