• ADA - Asylum Seekers Allowance AGDREF 
• Application for the Management of Foreign Nationals' Files in France ANEF
• Digital Administration for Foreigners in France DGEF
• General Directorate for Foreigners in France DNA
• National Reception System for Asylum Seekers and Refugees GUDA
• One Stop Shop for Asylum Seekers OFII 
• French Office of Immigration and Integration Applicable Regulations 
• the European Regulation n°2016/679 on data protection of April 27, 2016 (RGPD) and the Data Protection Act n°78-17 of January 6, 1978 SPADA 
• Structure of First Reception of Asylum Seekers

The protection of Personal Data is an essential element for the OFII. In accordance with Applicable Regulations, the OFII is committed to ensuring the protection, confidentiality and security of the Personal Data of users. When using the Portal for foreigners in France platform, personal data is collected and processed in order to facilitate the management of your file.

The OFII and the DGEF are co-responsible for the Portal for foreigners in France processing. If you have any questions or comments about this Policy and our personal data protection practices, or if you wish to complain about non-compliance with applicable privacy laws, you may contact the Data Protection Officer (DPO) of the OFII by e-mail at the following address: dpo@ofii.fr. The data controller at the DGEF may usefully be contacted at the following address: dpanef-dgef@interieur.gouv.fr.

The OFII is responsible for the processing of all activities within the OFII perimeter. The DGEF is responsible for all the activities within the scope of ANEF. 

The Portal for foreigners in France is a platform implemented jointly by the DGEF and the OFII as part of their public interest missions. Within the framework of the use of this platform, several data processing operations are implemented. This platform is necessary for :

• To allow the foreign national to consult his personal data recorded when his file is handled by the DGEF and the OFII included in the various related processing operations ;
• Allowing the foreign national to carry out dematerialized exchanges with the agents of the administrations in charge of monitoring his procedures in order to modify his data and to report any change in his personal situation ;
• Fluidify the exchanges of personal or generic information between the user and the administrations;
• To better coordinate the action of the services in charge of implementing procedures concerning foreign nationals;
• Ensure the follow-up of these requests and establish statistics on the number of visits to the various requests;
• Enable you to contact an OFII representative to answer your questions.

The processing of personal data is carried out in accordance with the wishes of the French State. It makes it possible to facilitate a foreigner's journey and to dematerialize procedures by improving exchanges with the administrations in charge of managing his file and procedures. The data collected in the context of this processing is not used for any other purpose than those listed above.

To facilitate the management of administrative procedures for foreigners, the DGEF, the OFII and prefecture agents collect several personal data. Among these data, we find data relating to the civil status and personal situation of the foreign user. This data is initially collected by prefecture agents under the supervision of the DGEF or the OFII, the DGEF and the OFII directly from these users, in particular during the GUDA interview or when they carry out the relevant formalities and procedures, either electronically or in person. Subsequently, as part of their missions, the DGEF and the OFII generate the data relating to the administrative situation, the conditions of reception, accommodation and support of the foreign user within the Information Systems. Some of this data is made available to the Portal for foreigners in France platform by federated processing. Indeed, the data appearing on the platform are uploaded thanks to specific secure exchanges (via dedicated inter-Information System data flows) and made available to agents and foreign users via the portals provided for this purpose. In the context of processing, the Prefecture and the DGEF collect and determine the following personal information from the user:

• Civil status and personal situation of the foreign national: Name of birth, Name in use, First name, Sex, Date of birth, Country of birth, City of birth, Nationality, Family status, E-mail address, Telephone number, Home address, Family composition,
• Date of update of the family composition ;
• The foreign identifier is automatically generated in order to allow the user to have a unique reference for all his steps on which the authentication procedure is based;
• Administrative situation of the foreign national: Date of entry into France, Reason for TSE or TVE (residence or travel permit)/current visa, Administrative documents (certificate of asylum application, notification of decision, etc.), administrative decision giving cause for complaint.

The OFII collects various types of information from users:

• Reception conditions of the foreign national: Date of signature of the OPC, Accommodation status, Date of accommodation, Surname and first name of the ADA holder, Method of payment of the ADA, Amount available on the ADA card, Last 4 digits of the ADA card, Validity dates of the ADA card, Status of the ADA card, Surname and first name of the holder of the RIB, IBAN, BIC, Amounts of ADA payments,
• Dates of ADA payments, Status of ADA payments, Period covered by the payment, Number of days covered by the payment ;
• Conditions of accommodation and accompaniment of the foreign national: Name of the accommodation center, Address of the accommodation center, Telephone number of the accommodation center, Name of the SPADA, Address of the SPADA, Telephone number of the SPADA ;
• Administrative situation of the foreign national: Documents (certificate of end of entitlement; certificate of payment; certificate of eligibility; notification to report for ADHD; notification to report for accommodation; provisional family certificate).

The Portal for foreigners in France platform connects different federated treatments. This is why it is necessary to distinguish the retention periods per treatment. With regard to the AGDREF2 processing, any file that has not been updated within five years of the recording of the first data it contains is deleted from the processing, in accordance with Article R. 611-7-1 of the CESEDA. With regard to DNA processing, the maximum data retention period is set at two years from the notification of the final decision on the asylum seeker's asylum application, in accordance with the provisions of Article R. 744-49 of the CESEDA. Concerning user logs, these data must be kept for the analysis of possible anomalies. These user logs must be kept for three months from the last user connection.

These data are processed by OFII and DGEF agents for the administrative management of the foreign user's file. The personal data used in the context of the Portal for foreigners in France processing is also intended for foreign users or their legal representatives, and is accessible to them via the user portal to facilitate their administrative procedures and information. This means that the user may have access to his/her own data. In fact, a recipient is a person (natural or legal person), public authority or service that receives communication of personal data, whether a third party or not. Consequently, the user himself, OFII and DGEF agents are recipients of the data.

The Portal for foreigners in France does not store any personal data. The Portal for foreigners in France platform relies on specific data flows between the various media listed below. It is specified that no transfer of data to entities located outside the European Union is carried out.

The OFII has a multitude of information media, including different categories. 
Firstly, there are the information systems and in particular :

• The SI OFII which temporarily hosts the components of the Portal for foreigners in France platform pending future migration to the IM cloud (DNUM hosting). It also hosts the technical bricks of presentation allowing the provision of information to be processed by Portal for foreigners in France;
• The ANEF IS, which essentially hosts technical presentation bricks allowing the provision of information to be processed by Portal for foreigners in France. This IS also hosts certain authentication bricks.

Secondly, we find the hardware and in particular :

• The servers and VMs which are maintained and hosted by the OFII in its own data center and are due to be migrated in the short term to the IM cloud (hosted by the DNUM);
• The user terminals which are controlled by the OFII, the prefectures or the DGEF and made available to agents as well as equipment belonging to user nationals and not controlled by the OFII or the DGEF ;
• The SPADA terminals are terminals made available in SPADA in order to allow access to Portal for foreigners in France for foreign nationals using the Portal for foreigners in France who do not have a personal terminal;
• The communication relays are various network equipment;
• Firewalls are security solutions positioned at the interface of the various information systems.

Thirdly, we find the software and in particular :

• The keycloack which is an authentication brick for the users and users part;
• The active directory which is an authentication brick for the technical administration part (LOT 1);
• The web browsers for which the platform is compatible with Firefox, Google Chrome, Internet Explorer, and Safari browsers.
• The web frontend of the Portal for foreigners in France platform which is accessible to users via a browser;
• The API, the API REST and the web services which are dedicated to the processing of requests to the databases feeding the Portal for foreigners in France platform in order to display them via the GUI;
• The middleware including Drupal, RabbitMq, application components, Synfony, OS and many others.

Fourthly, there are the computer channels and telephone channels and in particular :

• Internet ;
• The WIFI ANEF and OFII as well as other networks, including public networks or hotspots ;
• The incoming and outgoing flows called "external exchanges " which allow the Portal for foreigners in France to exchange with external IS hosting the subsequent processing ;
• The interapplication flows which notably allow exchanges between the different technical bricks of the platform and the databases, including the NFS.

Finally, the persons can also convey information, in particular :

• The Portal for foreigners in France user agents, who are specially authorized functional agents;
• The Portal for foreigners in France users who are foreign nationals with a foreign identifier;
• The Portal for foreigners in France administrators who are specially authorized agents of the prefectures, the DGEF and the OFII in charge of the administration and operation of the IS;
• The data recipients who are exclusively specially authorized personnel who may receive communication of the information handled in the context of the Portal for foreigners in France processing.

The OFII and the DGEF use all the technical and organizational measures necessary to guarantee the confidentiality and security of the personal data processed.

The OFII has a multitude of information media, including different categories.

The organizational measures put in place are as follows :

• Organization of the privacy policy ;
• Managing the privacy policy ;
• Managing risks ;
• Integrate privacy protection into projects ;
• Manage security incidents and data breaches;
• Personnel Management ;
• Oversee privacy protection;
• Project Management.

The data measures put in place are as follows :

• Encryption ;
• Partitioning ;
• Logical access control ;
• Logging & Traceability ;
• Data minimization.

The general system security measures implemented are as follows :

Securing the operation ;

• Securing the operation ;
• Fight against malicious software ;
• Workstation management ;
• Web site protection ;
• Maintenance ;
• Securing computer channels ;
• Physical security ;
• Hardware security ;
• Removal of risk sources & Protection against non-human risk sources.

The Applicable Regulations allow users to benefit from a set of rights regarding the personal data subject to such processing. These rights include the right of access, the right of rectification and, in applicable situations, the right of deletion. You have the right to request information on the origin of your personal data, its use or its retention time. Concerning the right of access, users, their descendants, representatives and/or agents have the right to access, consult and request a physical or electronic copy of the information that the DGEF or OFII holds about them.
With respect to other rights, users, their descendants, representatives and/or agents have the right to request the deletion of personal data concerning them. The DGEF and the OFII may be required to retain some of the personal data processed, following a request for deletion, in order to meet legal or contractual obligations. In the sole case where the right to erasure can be exercised, it is pointed out that such erasure could lead to the suppression of the rights as an asylum seeker.

All of these rights can be exercised through several channels of contact:

• By mail to the prefect of the place of residence in charge of the administrative file;
• By generic information e-mail: dpanef-dgef@interieur.gouv.fr ;
• By mail: OFII - For the attention of the DPO at the following address: 44, Rue Bargue 75015 Paris ;
• By e-mail: dpo@ofii.fr. A copy of an identity document or any other proof of identity may be requested to be attached to an application if necessary. If the request is submitted by someone other than the person concerned, without proof that the request is legally made on his or her behalf, the request will be rejected.
   

In the event that the response to a request is not satisfactory, users or any other person concerned have the right to file a claim with the CNIL https://www.cnil.fr/fr/plaintes.