Foreword

Istec places great importance on respecting privacy and complying with applicable regulations.

As part of its operations, Istec collects and processes personal data relating to contacts, prospects, clients, service providers, and partners.

The main objective of this document is to provide, in a concise, transparent, understandable, and easily accessible format, information regarding the data processing implemented, enabling you to understand the conditions under which your data is processed.

Through this policy, Istec is committed to complying with EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”), applicable since 25 May 2018, and the French Data Protection Act No. 78-17 of 6 January 1978, as amended, relating to information technology, data files and civil liberties.

General Principles

In accordance with Article 5 of the General Data Protection Regulation (GDPR),

the collection and processing of your personal data comply with the following principles:

• Lawfulness, fairness, and transparency: the collection and processing of personal data may only be based on a clearly defined legal basis (performance of a contract, legal obligation, consent, legitimate interest, protection of vital interests).
• Specified, explicit, and legitimate purposes: the collection and processing of personal data are carried out to fulfill one or more specific purposes.
• Data minimization: only the data strictly necessary for the proper execution of the purposes pursued are collected.
• Limited retention: personal data retention periods are defined to meet the needs of processing activities and our legal obligations.
• Security of collected and processed data: The data controller is committed to ensuring the integrity and confidentiality of the collected data.

Who are we?

Istec Business School Paris, a graduate school of business and marketing, acts as the data controller for the activities described below.

Personal data processed

Personal data processed

Category	Example
Civil status, identity, identification data	Last name, First name, Civil status
Personal life	Address, email, phone number
Profession, employer, workplace, email, work phone number
Financial information	Bank details, payment information
Connection data	IP address, logs Events
Cookies, trackers	Audience measurement, social networks

Data subjects

This policy applies to all individuals who are in contact with Istec, and each data processing activity lists the data subjects.


Data Processing – Objectives

The data processing implemented by Istec has the following purposes:

1. Contact Management

• Objectives
  • The purpose of this processing is to manage requests made on the Istec.fr website.
  • Data Category
    • Civil Status, Identity
    • Contact Information (email, phone number, etc.)
    • Managing the Follow-Up to Requests
  • Data Subjects
    • Any website user (Applicant, parents, candidate, student, learner…) who submits a request via a contact form, an email address on the website, or the chatbot.
    • Members and staff of Istec
  • Legal basis
    • Article 6(1)(f) of the General Data Protection Regulation (GDPR)
    • Istec’s legitimate interest in facilitating contacts to develop its business.

   

  2. Event registration management

  • Objectives
    • Managing registrations for Istec events:
      • Managing invitations, registrations, and logistical organization of events
      • Quality evaluation and statistics related to events
    • Data category
      • Civil status, identity
      • Contact information (email, phone, etc.)
      • Level of study
      • Desired training
      • Managing the follow-up to requests
      • People concerned
        • Any user of the site (applicant, parents, applicant, student, learner, etc.) who makes a request via a contact form, an email address found on the site, or the Chatbot.
        • ISTEC department members involved in the request
      • Legal basis
        • Article 6(1)(f) of the General Data Protection Regulation (GDPR)
        • Legitimate interest of ISTEC in carrying out communication activities to develop its business.

       

      3. Entrance Exam Registration Management

      • Objectives
        • Manage registrations for the various Istec entrance exams:
          • Management of follow-up actions for registrations
          • Management of invitations, registrations, and organization of exams.
          • Data Category
            • Identity, contact information (email address, telephone number)
            • Disability Status
            • Highest Degree Obtained
            • Educational Status current
          • Persons concerned
            • Anyone wishing to register for an Istec entrance exam.
            • Members of the relevant Istec departments.
          • Legal basis
            • Article 6(1)(b) of the General Data Protection Regulation (GDPR)
            • Contractual and pre-contractual measures necessary for pre-registration for entrance exams

           

          4. Newsletter Management

          • Objectives
            • Managing the sending of the Istec newsletter following subscription on the Istec.fr website:
            • Subscription Management
            • Compiling statistics related to these subscriptions
          • Data Category
            • Identity to personalize our communications
            • Email Address
            • Subscription Date
            • Statistics related to the service of the newsletter
          • Data Subjects
            • Data processing concerns individuals who wish to receive the Newsletter.
          • Legal Basis
            • Article 6(1)(a) of the General Data Protection Regulation (GDPR)
            • Consent of the individual, validated by submitting the subscription request via the dedicated form or during contact by selecting the appropriate option.

           

          5. Data Analysis
          • Objectives
          • To obtain statistical reports on website user activity in order to improve our business offering.
          • Data Category
          • Data relating to website visitors (unique visitor identifier, IP address, technical data, browsing data, etc.),
          • Data relating to transactions carried out on the Istec website (order number, total amount).
          • Data Subjects
            • Any website user
            • The Istec agency
            • Istec Communications Department
          • Legal Basis
            • Your consent (you have the right to withdraw your consent at any time).

           

          6. Payment Management
          • Objectives
            • To process a transaction related to Istec registration.
            • Data Category
              • Personal data provided during a transaction (billing/shipping address, email, name, surname, bank details, etc.)
              • Data Subjects
                • Any candidate who has received a positive admission result from Istec
                • Istec Admissions Office
                • Istec Accounting Department
              • Legal Basis
                • A contractual obligation.

               

              Sharing and Storage of Your Data

              Data Retention Period

               

              Data is kept for 3 years from the date the application is processed.

              Data related to our electronic communications is kept until the recipient withdraws their consent via the unsubscribe link provided in each message.

               

              Recipients & Sharing your data

              Istec does not sell the personal data it collects to third parties. This data is shared solely for purposes related to its activities. It is shared as follows:

            • Internally, with departments authorized to carry out these tasks
            • With suppliers and subcontractors. Istec requires them to sign contracts containing clauses that ensure a level of data protection, confidentiality, and security that complies with regulatory standards and best practices.

            Your data may be disclosed to the competent public authorities upon their request, in accordance with regulations, particularly for the purpose of investigating and prosecuting offenses.

            Data transfer outside the EU

            Istec uses subcontractors and suppliers under conditions that involve data transfers, particularly to the United States.

            Personal Data Security

            Istec places particular importance on the security of personal data. We have implemented technical and organizational measures adapted to the sensitivity level of the personal data, in order to ensure the integrity and confidentiality of the data and to protect it against any malicious intrusion, loss, alteration, or disclosure to unauthorized third parties. However, the security and confidentiality of personal data depend on everyone’s best practices, and therefore, the data subject is encouraged to remain vigilant on this matter. In this regard, you can consult the website cybermalveillance.gouv.fr and in particular Best Practices.

            Your Rights

            Istec is particularly committed to respecting your rights regarding the data processing it carries out, in order to guarantee fair and transparent processing, taking into account the specific circumstances and context in which your personal data is processed.

            How to Exercise Your Rights

            For any information or to exercise your rights regarding data processing and privacy concerning personal data managed by Istec, you can contact the Data Protection Officer (DPO):

            • Via the form “Contact the DPO”
            • Or by mail (with a copy of your identity document if you are exercising your rights, unless the information provided in your request allows us to identify you with certainty) to the following address:

            Istec Business School Paris
            Data Protection Officer
            128 quai de Jemmapes
            75010, Paris

             

            If you are dissatisfied with how your personal data or your requests under the GDPR or the French Data Protection Act are processed, you can file a complaint with the supervisory authority (CNIL).

            Glossary

            Personal Data (or Personal Information): any information relating to an identified or identifiable natural person, i.e., information that allows them to be identified directly (e.g., name and surname) or indirectly (e.g., cookies).

            Processing of personal data: any operation or set of operations (automated or otherwise) performed on personal data or sets of personal data, such as collection, recording, organization, storage, transmission of data (…)

            Data controller: the entity that determines the purposes (objectives) and means of the processing.

            Data processor: the entity that processes personal data on behalf of the data controller and under its instructions.

            Changes to this policy

            We encourage you to review this policy regularly tick on our website. It may be subject to updates.