login

Cyberchaze

## 1. Protection of personal information

Schneider Electric is a global company that commits to ensure an adequate level of protection for personal information in compliance with applicable laws. In its efforts to protect personal information, Schneider Electric has adopted a Global Data Privacy Policy which imposes common rules for the collection, use and disclosure of personal information by all Schneider Electric entities globally and aims at ensuring the protection of personal information within the Company. The Global Data Privacy Policy is available on Spice Portal [https://schneiderelectric.policytech.eu/dotNet/documents/?docid=8181](https://schneiderelectric.policytech.eu/dotNet/documents/?docid=8181).

## 2. Who collects and uses your personal information, and why?

Schneider Electric Industries SAS, 35 rue Joseph Monier, 92500 Rueil Malmaison, France, Schneider Electric’s Head Office, releases the Company’s policies relating to learning and training and is data controller of the related global data processing activities.

Schneider Electric affiliates are data controllers of the data processing activities performed in the framework of their own operations. PSO - Capture The Flag is a learning platform for Schneider employees to enhance and upskill their cybersecurity skill set. In the framework of PSO - Capture The Flag, personal information is processed for the following purposes:

- User management and authentication.
- To monitor and improve user experience by analyzing scores and time spent on challenges.
- To tailor the app’s challenges based on user’s performance.
- To manage rankings, leaderboards.
- To detect and prevent any fraudulent activity or misuse of the platform.

These data processing activities are based on your consent, you will therefore be given the possibility to withdraw it (see section 6 of this notice). Schneider Electric does not make decisions based solely on automated processing which may produce legal effects or similarly affect you on the basis of the personal information processed for the above purposes.

### 3. What types of personal information do we process?

We process the following categories of personal information:

Data obtained from you when filling in the form:
- Identification information, such as full name, gender, college/university name etc.

Data from the Company IT Systems/Organization:
- Identification data (e.g. SESA, Person ID number, Email Address) Data computed, inferred, or produced:
- [Individual/Team CTF score] Logs are kept for security purposes.

### 4. How long do we keep your personal information?

The data on the portal will be cleared after each event and data will not be available after the event. Data at rest during the event is stored and encrypted. Technical logs will be kept for 90 days.

### 5. Who do we share personal information with and where is it processed?

Personal information will be processed by our affiliates and suppliers involved in the performance of the purposes described in Section 2. We take measures to ensure that personal information receives an adequate level of protection. Service providers are engaged with us to respect the confidentiality and security of your personal information. As we are a global company, teams and suppliers may have global or multi-country roles, and they can be located anywhere in the world, in countries with different privacy standards than your country of residence. We have internal policies applied by our affiliates and we conclude contracts with our suppliers to ensure appropriate safeguards. Our group has adopted Binding Corporate Rules (BCR). In addition, we conclude Standard Contractual Clauses and rely on EU Commission’s adequacy decisions. To obtain more details and copies of safeguards put into place, you may contact global-data-privacy@schneider-electric.com.


We may also share your personal information, as necessary:
- with competent authorities, based on a good faith belief that disclosure is necessary to respond to a judicial process, a valid official inquiry, or if otherwise required by law (e.g., tax authorities, social security, government authorities);
- to defend our legal rights, or to protect the rights or safety of any person or entity;
- with employee representatives in accordance with applicable laws or as legally required;
- as instructed by you;
- with third parties in the context of reorganization of operations;
 
### 6. How to exercise your choices and rights about your personal information?

To exercise the data protection rights granted under applicable data protection law, such as the rights to be informed, to access, to rectify, to withdraw consent, to request restriction or erasure, the right to object and data portability, you may:

contact HR Services using PeopleLink, Support@Schneider; in countries where these channels are not available, please contact the HR admin team.

You may address questions or comments about our privacy practices or this privacy notice to our Group Data Protection Officer: [DPO@schneider-electric.com](mailto:DPO@schneider-electric.com) DPO 35 rue Joseph Monier CS 30323 92506 Rueil Malmaison France.

If you believe that we have processed your personal information in violation of applicable law, you may file a complaint with the Group DPO at the contact details above, or with a supervisory authority. The Lead Authority competent for Schneider Electric Industries-SAS activities is the CNIL in France. The list of EU supervisory authorities is available [here](https://edpb.europa.eu/about-edpb/board/members_en). This privacy notice may change from time to time. We will provide information about material changes. 

Last updated: March 2024