Personal data charter

Personal data charter

The purpose of this data charter related to the collection and processing of personal data (hereinafter referred to as the “Charter”) is to inform Internet users of the processing of their data in the context of :

  • the use of an online service (Institution’s website, intranet, digital work environment (hereinafter referred to as “ENT”), the Institution’s social networks, Alumni website, etc.) ;
  • application and registration files related to the Institution ;
  • registrations for Open Days or any other event offered by the Institution ;
  • the administrative and educational management of their file regarding the offered trainings.

Personal data processing is carried out in accordance with the applicable regulation (EU) 2016/679 regarding the protection of natural persons with regard to personal data processing and to free transfer of such data (hereinafter ” RGPD ») and to law n ° 78-17 relating to IT, files and freedoms.

For any questions or requests related to the processing of personal data, you can send an email to our Data Protection Officer (“DPO”) at the following email address : dpo[a]groupe-igs.fr.

The information on data processing is presented as follows :

  1. The controller
  2. The persons concerned by the collecting and processing of personal data
  3. Categories of personal data which are processed by the Institution
  4. Information on the data processing
    • 4.1. Information on personal data processing collected on the website
    • 4.2. Information on personal data processing collected via paper forms (application form, registration form in the Institution, Open Days or discussion forums, participation in webinars, etc.) and in the context of Student/Apprentice life within the Institution :
  5. Data recipients or categories of data recipients
  6. Transfer of personal data
  7. Personal data security and confidentiality
  8. “Information technology and freedoms” rights and requests related to personal data processing
  9. Charter update
  10. Cookies management
    • 10.1. Find out more about cookies and their settings
    • 10.2. What are the cookies that can be stored on a terminal and how can they be managed? – Technical cookies – Audience measurement, advertising and “social network” cookies
    • 10.3. Cookies from our partners (known as “third party cookies”)
    • 10.4. Choice regarding cookies management (consent to deposit and withdrawal of consent)
    • 10.5. Set cookies directly from the browser and your mobile devices
    • 10.6. Length of cookies storage

The educational Institution (referred to as “the Institution”) management body (or bodies) are responsible for personal data processing . You can access information related to the body (or bodies) identity managing the educational institution in the “Legal Notice” section of the Institution’s website.

Persons concerned by personal data processing are defined below as :

  • Alumni: Student or Apprentice who has either completed or not a training at the Institution, whether or not he/she is a graduate ;
  • Candidate: any natural person who has started to complete or already completed an application file (digital or physical) or who has let the Institution know about their wish to apply for a training;
  • Company contact : any natural person working for a company who monitors the Student / Apprentice during an internship or work-study program (tutor, internship supervisor, etc.);
  • Student : any natural person registered in the Institution and following classes during the current academic year;
  • Apprentice : any natural person registered in the Institution and following a work-study training during the current academic year;
  • Web user : any natural person browsing this website (hereinafter referred to as the “website”);
  • Speaker: any natural person in charge of an educational service in the Institution (freelance or employee of the Institution);
  • Partner : any natural or legal person who has entered into a partnership contract with the Institution;
  • Concerned person: any identified or identifiable natural person within the meaning of Article 4 of the GDPR, and in particular Apprentices, Candidates, Company Contacts, Students, Prospects and Third Party Payer.
  • Staff : all natural persons employed or not by the Institution;
  • Service provider : any natural or legal person who has signed a contract with the Institution to provide services;
  • Prospect : any natural person interested or who may be interested in a training or an event offered by the Institution, or who expressed an interest in a graduating training or not offered by the Institution;
  • Respondent : any natural person who sends a letter of recommendation to the Institution in favor of a Student or an Apprentice ;
  • Legal representative : any natural or legal person in charge of representing the Student / Apprentice
  • Third-party funder : any natural or legal person who is responsible for financing the training of a Student / Apprentice, in particular regarding the payment of tuition fees or as a surety;

Unless objected requirement resulting from the context, the definitions of the Concerned persons above available in singular include the plural form.

The Institution processes personal data of Concerned persons within the framework of the Processing Purposes as detailed in paragraph 4 of the Charter.

The categories of data below are mentioned for information only and are processed according to the application file completed by the Student / Apprentice or according to the information communicated by the company that has registered its employees in a training offered by the Institution.

The categories of processed personal data stand as follows :

Students / Apprentices :

Connection data : IP address, username and password, connection logs, internet visited pages, used browser, operating system, history of visited websites, download history, used language, verification of compliance with deadlines on the work requested to Students / Apprentices, monitoring the connection time of Students / Apprentices;

Identification data : civil status (title, surname, first names, date and place of birth, nationality), copy of the national identity card, passport or any other official identification document (including residence permits), landline number and / or mobile phone, personal e-mail address, identifier or identification number assigned by the Institution, Pôle Emploi identification number, signature, social security number (only for Apprentices);

Images and sounds : image recordings (video surveillance, student / apprentice face-to-face verification as part of remote courses), Photography, Sound recordings;

Personal data : family situation (single, married, cohabiting), postal address, email address, household composition (number of children), accomodation file ;

Professional / school life data : national student identifier (NSI), email address provided by the Institution, professional and school / university experiences (Resume), training (transcripts from previous years), copy of diplomas, entry interview reports in training, results of placement tests, results of admission tests, spoken language (1st and possibly 2nd foreign language), attendance sheets, disciplinary procedures, role within the company as well as email address and professional telephone number in the event of an internship or work-study program, home institution, previous class, options followed during the current year and the previous year, year of entry into the institution, position (repeat or not), grades obtained during the current training, information on any current internships or on work-study programs (internship / work-study agreement), absences and delays, teachers’ comments on the level and progress or cunes of Students / Apprentices, marks obtained in competitions or admission tests;

Economic and financial information : data related to the means of payment (check, bank identity statement), data related to the settlement of invoices (schedule, outstanding amounts, reminders, balances), last tax notification, copy of the work contract, student bank loan certificate, supporting student scholarship document, bank loan;

Medical data: medical documents justifying a disability.

Legal representative :

Identification data: title, last name, first name, postal address, email address, phone number, signature;

Economic and financial information : last tax notification (information processed as part of a scholarship application file completed by a Student / Apprentice); pay slips (for Legal Representatives living abroad – information collected only as part of the scholarship application files offered by some institutions of the IGS Group).

Company contact :

Identification data: last name, first name, business phone number, business email address.

Professional life data: role within the company.

Respondent :

Identification data : title, last name, first name, postal address, email address, phone number.

Professional life data : function

Third party funder :

Identification data : title, surname, first name, postal address, email address, telephone number, proof of identity (copy of the ID card or passport), signature.

Economic and financial information : means of payment, bank identity statement (in case of payment by direct debit authorization).

Alumnis :

Identification data: title, name, last name during training, first names, personal email address, date of birth, postal address, email address, phone number.

Professional / school life data : role of the person within the company, information on the apprentice educational and professional paths (diplomas obtained, path provided by the graduate, class, group, division attended (with year), date of entry into the company, phone number, professional faxes, professional email, annual salary (if provided by the Alumni).

The Concerned persons personal data are never to be sold, marketed or rented by the Institution to third parties, and are not subsequently processed in an incompatible way with the purposes as detailed below, nor beyond the length of predetermined processing.

The Concerned persons collected information are, in particular, the subject of computer processing intended for prospecting operations for similar services. Each Concerned person is likely to receive information on the various training courses offered by the Institution. Any Concerned person may object at any time and without reason to any future solicitation sent by the Institution by sending an email to the Data Protection Officer at the email address mentioned on page 1 hereabove.

4.1. Information on the processing of personal data collected on the website

Purpose of processing Legal basis Storage length in active basis
Open House requests Management Legitimate interest Processing duration of Open House registrations
Application and registration files Management Pre-contractual measures and / or execution of the contract Duration of the admission procedure and, if applicable, duration of the current training year
Newsletter Management Legitimate interest in responding to the request Preservation of the email address as long as the concerned person does not unsubscribe (via the unsubscribe link included in the newsletters)
Management of social networks and Chatbot Legitimate interest Duration of processing of the request
Contact forms Management (complaints, request for information, etc.) Legitimate interest Duration necessary to revert to the request
Cookies management Legitimate interest in technical cookies Consent for audience measurement or advertising cookies 13 months maximum depending on the cookies concerned
Management of online contribution areas Legal obligation 12 months

* The active database duration represents the time during which the data is used by the Institution staff before being archived for a certain time, in accordance with the prescription rules that can be applied in civil, commercial and fiscal matters and / or before being permanently deleted. As part of personal data archiving , these are no longer used by the Institution for the determined processing purposes, but are of administrative interest to the Institution (for example to sort a possible dispute) or must be kept to meet a legal obligation. The data are then accessible on an ad hoc basis motivated by specifically authorized persons.

4.2. Information on the processing of personal data collected via paper forms (application file, registration file in the Institution, open days or discussion forums, participation in webinars, etc.) and in the context of the Student / Apprentice life within the Institution

Purpose of processing Legal basis Storage length in active basis
Application and registration files (digital or printed) Pre-contractual measures and / or execution of the contract Duration of the admission procedure and, if applicable, duration of the current training year
Management of admission results in the Institution Pre-contractual measures and / or execution of the contract Duration of the admission procedure
Management of information relating to diplomas, grades, test results, documents related to the internship, etc. Legitimate interest Duration of the current training
Management of distance courses and face-to-face (camera) Legitimate interest Data from cameras (image / sound) are consulted without storage
Billing / accounting Legal obligation 10 years
Medical data (in particular for the management of third parties or the fitting out of premises / events) Consent Duration of the admission procedure and, if applicable, duration of the current training year
Data management of legal representatives in the context of application and registration files (digital or printed) Legal obligation Duration of the admission procedure and, if applicable, duration of the training
Management of internships and work-study programs (data relating in particular to Company contacts, Students / Apprentices, Internship supervisors, etc.) Legitimate interest Duration of the admission procedure and, if applicable, duration of the work-study program or internship carried out by the student in the concerned company
School file management (information sheets on the student and his family, quarterly transcript, individual guidance sheets, meeting reports, various help within the framework of social funds, elements concerning internships, elements concerning the student attendance and sanctions (disciplinary, exclusions), management of absences, internship reports, theses, etc.) Pre-contractual measures and / or contract application Training duration
Management of the student file including administrative and educational data (civil status, internal and external curriculum, individual admission decisions) Pre-contractual measures and / or execution of thecontract Duration of the admission procedure and, if applicable, duration of the training
Management of training fundings Pre-contractual measures and / or execution of the contract Duration of training
Management of the course of students abroad Pre-contractual measures and / or execution of the contract Duration of training
Management of online platforms made available to students and lecturers Legitimate interest Updated data at the beginning of each academic year. Deletion of data and identifiers linked to the accounts of the concerned platform within three months as soon as the concerned person is no longer intended to hold an account (leaving the institution / training entity)
Library borrowings management Legitimate interest Duration of ongoing training + until returning the books
Room management Legitimate interest Duration of the current training
Alumni Directory Legitimate interest Data kept until opposition exressed by a Student / Apprentice
Management of grant requests Pre-contractual measures and / or execution of the contract 2 years on an active basis Anonymous statistics: unlimited storage
Management of the placement of apprentices in companies for a work-study program or an internship Legitimate interest Data concerning apprentices are kept until the apprentice leaves the Institution Anonymous statistics: unlimited storage
Management of disciplinary sanctions Legitimate interest Duration of training
Management of disciplinary sanctions Legitimate interest Duration of training
Satisfaction surveys and production of statistics Legitimate interest Duration of the survey and compilation of statistics or report Anonymous statistics: unlimited storage
Management of various other services that may be offered to Students / Apprentices directly by the Institution or the Partners Pre-contractual measures and / or execution of the contract Duration of the contractual relationship
Management of connection data (connection logs making it possible to identify any Concerned person who has contributed to content creation posted online from the Institution’s internet connection) Legal obligation 12 months
Operations of prospection, commercial solicitation and external communication Legitimate interest for Students / Apprentices to offer similar services
, Consent of the Concerned person for Prospects
Legitimate interest in BtoB prospecting, Legal obligation
regarding the management of the opposition to prospection list
  • Duration of the Student / Apprentice presence in the Institution + 3 years from the end of the training or the last contact from the Student / Apprentice or the Former Student / Apprentice
  • 3 years maximum from data collection or from the last contact from the prospect
  • 3 years maximum from data collection or from the last contact from the prospect
  • 12 months
Video surveillance (fire / accident protection, prevention of damage to property, reporting of any incidents that have occurred or risks to be prevented) Legitimate interest 1 month maximum from recording the images
Management of vocational training agreements and apprenticeship training agreements with client companies Pre-contractual measures and / or execution of the contract Duration of training
Management of IT rights and freedoms exercised by Concerned persons Legitimate interest Right of opposition: legal obligation 12 months from the request

* The duration in active database corresponds to the duration during which the data is used by the Institution staff before being archived for a period in accordance with the prescription rules applicable in civil, commercial and fiscal matters and / or before being permanently erased. As a part of the personal data archiving, these are no longer used by the Institution for the determined processing purposes, but are of administrative interest to the Institution (for example for managing a possible dispute) or must be kept to meet a legal obligation. The data can then be consulted on an ad hoc basis and motivated by specifically authorized persons.

The personal data as well as the information transmitted are intended for the Institution Staff (and in particular for the secretariat, invoicing, communication, information services, management, teaching assistants and teachers and / or tutors) but also for the emergency services likely to take care of the student in the event of a medical emergency (ambulance, firefighters, etc.).

Medical data are collected in order to adapt to the possible Student / Apprentice disability, in particular for the exams to come at the end of the training. The administrative service of the Institution and any duly authorized person is the medical data recipient, in particular the doctor who would intervene in the Concerned person interest and / or possibly the emergency services in the event of a medical emergency (ambulance, firefighters…). In order to ensure the file follow-up, the Institution may request supporting documents during the year, depending on the kind of disabilityand the declared medical status.

The data may be forwaded to some subcontractors in order to enable the Institution to be able to provide the Student / Apprentice with the available service(s). These Service Providers act on the instructions of the Institution, and the Institution ensures that the transmitted data are processed only to deliver services, unless the Student / Apprentice has directly subscribed to the services of a Service Provider or has consented that the Service Provider uses these data for its own needs.

The Institution will inform you by any means when the data are forwarded to Service Providers / Partners for the needs of the services offered by the Institution as part of training, or if you have consented to it.

Some data may also be sent to several organizations below (hereinafter “Organizations”) :

  • to the Ministry of Higher Education and Research : Student / Apprentice data transmitted to this body : Data related to identity and contact details ; Data related to the young person’s last schooling ; Data related to the solutions and support offered to the youngster ; Data of Legal Representatives : Data related to identity and contact details.
  • to the Rectorate in order to establish statistics : Students / Apprentices data transmitted to this body : Data related to identity and contact details ; Data related to the young person’s last schooling ; Data related to the solutions and support offered to the young person ; Data of Legal Representatives: Data related to identity and contact details
  • to the Observatory of Student Life and Integration (OSLI) in order to allow surveys and statistics to be carried out on the living conditions of students : Student / Apprentices data transmitted to this organization : civility, sex, first name, name, national student identifier (INE), nationality, postal address, diploma obtained, postal address of parents, personal e-mail address, e-mail address provided by the Institution, telephone number, date of birth, registration procedure (training initial, continuing or learning)
  • to the Center for Studies and Research on Qualifications (CSRQ), a public Institution under the dual supervision of the ministry in charge of education and the ministry in charge of employment which conducts an original national survey system which makes it possible to study access to employment for young people at the end of their initial training : data of Students / Apprentices sent to this organization : last name, first name, email address, national student identifier (INE), sex, date of birth, postal address , telephone number (landline or mobile), diploma, registration system (initial, continuing or apprenticeship training).
  • to France Compétences, a French national public institution, in order to allow the Institution to meet its legal obligations in the context of requests for validation of the Institution’s certifications, monitoring and evaluating the quality of training actions and to obtain a regional funding for the training offered : Student / Apprentices data transmitted to this organization : surname, first name and data related to employment and professional background;
  • at the CNOUS (National Center for University and School Works), at CROUS (Regional Center for University and School Works) : Student / Apprentices data transmitted to these organizations : Data related to identity and contact details ; Data related to the young person’s last schooling ; Data related to the solutions and support offered to the young person ; Data of Legal Representatives: Data related to identity and contact details
  • to Organizations linked to OPCO-like continuing training : Students / Apprentices data transmitted to this organization : surnames and first names, telephone numbers, address, date of birth, start and end dates of contracts and the company where the employee works , email address, last diploma obtained, POLE EMPLOI identification number, status of disabled worker.
  • To the DREETS (Regional Directorates for the Economy, Employment, Labor and Solidarity) because of the legal obligations incumbent on the Institution concerning Apprentices employed by a client company : Student / Apprentice data transmitted to this organization : first and last names, telephone numbers, address, date of birth, start and end dates of contracts and the company where the employee works, email address, last diploma obtained, POLE EMPLOI identification number, status of disabled worker.

These bodies are solely responsible for processing Student / Apprentice data when transferred to them directly by the Institution.

In addition, the necessary data may be communicated to the following recipients depending on the obligations of the Institution : to the National Commission for Professional Certification (the data is pseudonymized) and to the Insurer of the Institution (only the first and last names, and periods of coverage are sent to the insurer).

The Institution has set up an Alumni directory, allowing in particular the sending of newsletters, invitations to events or the creation of professional integration statistics. The Institution may share the directory to the Alumni Association with information concerning the Student / Apprentice in order to make them accessible (only with username and password) to other Alumni.

In case of payment of tuition fees by the Student / Apprentice Legal Representative, this person will be the recipient of disciplinary correspondence or the delivery of any academic sanctions (transcripts, research grade, etc.).

The data may be transferred to the Institution’s Partners or Service Providers, and more generally to subcontractors for the services that the Institution offers to the Persons concerned as part of the trainings.

The Institution uses all the means at its disposal to ensure the protection and confidentiality of the transferred data, and in particular ensures that the Partners and / or Service Providers located outside the European Union ensure a level of data protection and the rights of Data Subjects (and in particular their privacy) under conditions equivalent to those guaranteed by the GDPR within the European Union if applicable.

In particular, the Institution signs the standard contractual clauses validated by the European Commission with its Partners / Service Providers and provides additional guarantees to ensure that the Partners / Service Providers comply with the requirements in terms of data processing and protection provided by the GDPR.

The Institution ensures for example, that the modification of the country legislation where the Partners / Service Providers are located is not likely to have significant negative consequences on the guarantees and rights of the concerned persons.

If not, the Institution asks its Partners / Service Providers to process personal data exclusively in the territory of a Member State of the European Union, unless expressly authorized by the Institution and special guarantee taken by the Partner / Service Provider.

The Institution implements appropriate measures to guarantee a suitable level of protection to the risk in terms of confidentiality, integrity, availability and resilience of the systems and, in particular, to prevent personal data from being are distorted, damaged or communicated to unauthorized third parties. The Concerned persons personal data and all of the communicated information by them are kept for internal use only and under suitable conditions to ensure their security and confidentiality according to the various processing purposes.

The Institution regularly checks internal procedures as well as technical and organizational measures to ensure that the processing under its responsibility is carried out in accordance with the requirements of the legislation in force on the protection of personal data and the protection of the Concerned persons rights.

In accordance with the regulations in force, any Concerned person may ask the Institution, through its Data Protection Officer (DPO) whose contact details are below, for the application of :

Any Concerned person also has a right not to be the subject of a decision based exclusively on automated processing, including profiling (https://www.cnil.fr/fr/profilage-et-decision- fully-automated).

Any Concerned person may lodge a complaint with the CNIL (National Commission for Informatics and Liberties) for any difficulty related to the processing of their data: https://www.cnil.fr/fr/plaintes.

For any request concerning personal data, please send an email to the Data Protection Officer at the email address mentioned on page 1 hereabove.

Students / Apprentices will be informed by any electronic mean of communication (email, intranet, ENT, etc.) of updates in the Charter.

10.1.Find out more about cookies and their settings

A “cookie” covers all cookies or trackers placed and/or read on a device (computer, mobile phone, tablet), for example when browsing a website.

As part of a visit on the website, information related to the Internet user’s navigation may be recorded on their equipment in cookie files placed by the Institution or by third parties. The cookie can contain several data : the name of the server which created it; an identifier as a unique number; an expiration date… This information can be stored on the Internet user’s computer in a simple text file which a server accesses to read and record information.

10.2. What are the purpose of cookies that can be stored on a terminal and how can they be managed?

Cookies have several functions.

  • Technical cookies

Technical cookies be useful for technical purposes to facilitate navigation on the website. These technical cookies make it possible to identify the Internet user, to help him fill out forms or certain fields, and to improve his navigation. Technical cookies also allow to implement security measures or to take into account certain choices made by the Internet user, such as language.

These cookies are simply intended for the operation of this website. They can be placed and read on the Internet user’s terminal, without the need for their consent.

If the Internet user “uninstalls” a technical cookie from their equipment, they will not be able to benefit from the services offered by the website.

  • Audience measurement, advertising and “social network” cookies

Audience measurement cookies are used to measure the audience for the various contents and sections of this website, and in particular to understand how users arrive on the website.

Advertising cookies allow the display of targeted advertising on a web page determined depending on the Internet user’s profile who consults the page, and more particularly according to the pages that he has visited.

This website has added social plug-ins to its pages to facilitate sharing its content on several social networks. These “social buttons” are used to direct the Internet user to the Institution’s social networks. Adding these “social buttons” to the Institution Site allows some social platforms to use cookies which track the navigation of the Internet users when they access the social network, even if they do not use them personally. The Internet user is therefore invited to consult the specific cookie management policies for each of these social networks in order to be aware of the purposes of the browsing information they may collect.

10.3. Choice in the management of cookies (consent to deposit and withdrawal of consent)

At any time, each Internet user can express or modify his/her wishes in terms of cookies, and in particular to know the list of Partners and their third-party cookies by the means described in paragraph

10.4 below or by clicking on the icon on the website.

The user can delete the cookies placed on his equipment.

To configure the management of cookies from the browser

Each browser’s configuration is different. It is up to the Internet user to follow the instructions of his browser’s provider as follows (links available on the update date of the “Cookies” page):

For Firefox: launch the browser then simultaneously press “Alt + O”; select “Options”; click on the “Privacy and security” tab then choose the required options. You can find these explanations on the following link: https://support.mozilla.org/fr/kb/autoriser-bloquer-cookies-preferences-sites

For Chrome: launch the browser then simultaneously press “Ctrl + H”; click on “Clear browsing data”, and check the box “Cookies and other site data”. Find these explanations on the following link: https://support.google.com/chrome/answer/95647?hl=fr&hlrm=en

For Safari : launch the browser then click on “Safari” at the top left; select “Preferences” then click on “Confidentiality”; click on “Manage website data”; select one or more websites then click on “Delete” or “Delete all”. Find these explanations on the following link: https://support.apple.com/fr-fr/guide/safari/sfri11471/mac

For Opera: launch the browser then click on “Settings” in the toolbar; select “Delete private data”; check the “Delete all cookies” box; click on “Delete”. Find these explanations on the following link: https://help.opera.com/en/latest/web-preferences/#cookies To setup cookies when using a browser other than those mentioned above before, please consult the CNIL website: https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-maitriser-votre-navigateur.

To disable advertising targeting and setup geolocation options for mobile devices

iOS : go to privacy settings, then :

  • for targeted advertising : go to the “advertising” option and activate “limited advertising tracking”;
  • for geolocation : go to the “Location service” option and setup the applications that can access the location data.

Android: for targeted advertising, go to the “Google settings” application, press “Ads”, activate the option “disable ads by interest” and “reset advertising identifier” .

10.5. Length of storage of cookies

The cookies stored in the Internet user’s terminal or any other element used to identify him for statistical or audience purposes will have a reasonable lifespan linked to the purpose of the processing within the limit of thirteen (13) months maximum. This duration is not automatically extended during new visits by the Internet user to the website. Beyond that, the raw traffic data associated with an identifier is either deleted or anonymized.

Legal notices
Cookies