Information notice regarding the management of PIX digital training courses

The University of Namur organises digital skills training courses using the PIX ORGA platform (https://pix.org/fr-be/). This allows teachers and other members of the university community to organise digital skills training courses for specific audiences, in particular students taking a course for which these skills are required. 

The organisation of these courses and the processing of the results involves the processing of data relating to trainers and learners. 

A special feature of the PIX ORGA platform is that it is part of a larger project led by the Ministry of the Wallonia-Brussels Federation, which aims to develop digital skills throughout the learning life cycle. Learners are required to use, and if necessary create, their own account, which is independent of their course at UNamur, on a web application created and managed by PIX (Public Interest Group "Pix", 21-23 rue des Ardennes, 75019 Paris). It is from this account that learners validate their skills by following the online training modules. 

For the purposes of this activity, the University of Namur processes data falling into the following categories:

• General identification data [category including the following types of data: surname, first name, postal address, email addresses, copy of identity card, identity photograph, telephone number, etc.]
• Identifiers assigned by UNamur [category including the following types of data: student number, internal registration number, eID for access to internal resources, access card identifiers, student card number, etc.]
• Application data [category including the following types of data: campaign ID, campaign name, course code, course name, percentage of progress, course start date, shared (yes/no), sharing date, details of validated achievements, details of assessed achievements and success rate per skill, etc.].
• Additional non-mandatory personal characteristics data (e.g. gender) (for statistical purposes in order to adjust the digital training policy according to identified needs).

This data is used to:

• Create training campaigns
• Invite learners to follow the created course
• Retrieve and process learners' results
• Manage technical support for use of the platform (ORGA PIX)
• Manage a training policy based on identified needs. 

Legal basis for data processing

Depending on the learner audience, the use of training courses is based on:

• With regard to students, processing is carried out because it is necessary for the performance of a task carried out in the public interest in the field of education (Article 6(1)(e) of the GDPR)
• With regard to University staff, the activity is carried out on the basis of the University's legitimate interest (Article 6(1)(f) of the GDPR). This legitimate interest consists of being able to train individuals in skills that are useful for the performance of their tasks and duties, or even required by law to ensure staff training in data protection. 

In addition, the University anonymises the related data for statistical purposes, which is in its legitimate interest to be able to adjust its digital training policy according to identified needs (Article 6(1)(f) of the GDPR). 

The categories of persons whose data are processed for the purposes of the activity are as follows:

• Participants in training campaigns (staff members and enrolled students) as learners or trainers.
• Internal administrators of PIX ORGA

The data included in the processing activity comes from the following source(s):

• The data is stored in a University database
• The data is generated by an activity of the person
• The data comes from another source as described below: 

The course is linked to a user account that the learner creates separately with PIX. 

When a learner participates in a pathway created by UNamur, the latter receives data from PIX when the learner agrees to share their results via their PIX account. 

The data is processed solely by the University's staff and departments for the purposes of carrying out the activity. The internal recipients of the data mainly belong to the following categories:

• University administrative staff
• Faculty and department staff

External recipients of data belong to the following categories:

• External service providers acting on behalf of and on the instructions of the University: PIX is also a subcontractor of the University in the context of a PIX ORGA service it provides, which enables UNamur to create and manage training courses for its users.
• In addition, PIX generates statistics on the use of the PIX ORGA Platform by users at the University of Namur for the Ministry of the French Community, which oversees the use of this platform by various actors in the Wallonia-Brussels Federation.

The retention period is determined based on the need to retain the data for operational purposes in accordance with the purpose of its use. 

Course data is kept for a maximum of 5 years. 

For students, data relating to their academic history is retained until they leave the university. Anonymised data is retained in order to measure the relevance and need for training in digital skills. 

Each year at the end of the academic year, data from the past academic year is extracted from the PIX ORGA Platform and anonymised. Data relating to students who are no longer enrolled for the coming year is deleted from the Platform. 

These retention periods are specific to the processing carried out by UNamur. Learner data is stored in the user account that they have created with PIX, which is independent of their enrolment and studies at UNamur. 

Data subjects have rights which are described on the page https://www.unamur.be/en/privacy-policy. Any requests or questions relating to the files processed can be sent to tice@unamur.be.

Processing for which GIP PIX is data controller

The French public interest group Pix (the "GIP Pix") develops and provides the Pix platform. GIP Pix is responsible for processing its users' data for the administrative management of their user accounts, compiling statistics with a view to improving its platform, and for skills tests carried out independently on Pix (i.e. tests/courses not prescribed by the University of Namur). 

For more information on the data processing carried out by GIP Pix, its Personal Data Protection Policy is available at the following address: https://pix.fr/politique-protection-donnees-personnelles-app.

Processing for which the Ministry of the French Community is data controller

The Ministry of the French Community (Boulevard Léopold II, 44, 1080 Brussels, Belgium; http://www.federation-wallonie-bruxelles.be/a-propos-de-la-federation/l…) has entered into a partnership agreement with GIP Pix to deploy the Pix tool in the education sector in the Wallonia-Brussels Federation. In its capacity as regulatory authority, the Ministry commissions the GIP Pix to compile statistics on the deployment and use of Pix by the education sector. In this sense, it is considered responsible for this processing under the GDPR. 

The results and progress data are anonymised for the purpose of compiling these statistics. 

This processing of the data is necessary for the purposes of the legitimate interests pursued by the Ministry (within the meaning of Article 6(1)(f) of the GDPR) in its capacity as a regulatory authority. 

The "raw" data used to compile statistics is never transmitted to the Ministry. The statistics are compiled directly by GIP Pix (in its capacity as a processor) on the basis of instructions given by the Ministry. The data is kept for the time necessary to fulfil the purpose of producing statistics. 

To exercise the rights granted by the GDPR with regard to this processing for statistical purposes, you should:

• Send an email to the Ministry's data protection officer at the following address: protectiondesdonnees@cfwb.be;
• State the right you wish to exercise and indicate the information you require;
• Specify that this concerns the processing of Pix statistics;
• Provide proof of identity by attaching, for example, a copy of your identity card (front and back) to the application, with a dated initials, the words "Ministry of the Wallonia-Brussels Federation", the date and the subject of your application (so that it cannot be used for other purposes at a later date). This copy is only accessible to the data protection officer and is automatically deleted as soon as identification and authentication have been carried out with certainty.