This policy describes how Institut Imtiyaz collects and uses your personal data on the website https://institut-imtiyaz.com (hereinafter “the Site”), in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978, known as the “Loi Informatique et Libertés” (French Data Protection Act). Data is collected directly from you when you fill in a form, place an order or browse the Site.
Data controller
The data controller is Idrîs de Vos, sole proprietor (“Imtiyaz EIRL”), 9 rue Fernand David, 74200 Thonon-les-Bains, France. Contact: idris.devos@institut-imtiyaz.com. No data protection officer has been appointed.
Data collected, purposes and legal bases
Course pre-registration and student follow-up
The pre-registration form collects your name, email address, telephone number, desired level and availability. This data is used to process your request, form the groups, confirm your place and the payment terms, and then to manage the courses. Legal basis: pre-contractual steps taken at your request and performance of the contract (Article 6(1)(b) of the GDPR).
Purchase of digital products
When you place an order in the shop, we process your identity, your email address, your billing details and the details of the order in order to deliver the product, issue the invoice and provide follow-up. Your bank card details are entered on the secure interface of the payment provider (WooPayments – Stripe) and do not pass through the Site. Legal bases: performance of the contract (Article 6(1)(b)) and accounting obligations (Article 6(1)(c)).
Newsletter and emails to students
Subscription to the newsletter is voluntary and based on your consent (Article 6(1)(a)); each email contains an unsubscribe link. Students also receive the information needed for the running of the courses (performance of the contract) and may be informed of similar courses or products on the basis of our legitimate interest (Article 6(1)(f)), with the possibility of objecting at any time, in particular via the unsubscribe link. These emails are sent via the service provider Brevo.
Testimonials
The testimonial form collects your first name and your text, which are published on the Site only with your consent (Article 6(1)(a)) and removed at any time on simple request.
Comments
When you comment on an article, the information entered in the form (name, email address, comment) and your IP address, automatically recorded by WordPress, are processed to enable discussion, moderation and the filtering of unwanted messages (legitimate interest, Article 6(1)(f)). This filtering is carried out locally, without any third-party service. Your email address is not published.
Audience measurement
The Site uses Google Analytics 4 (Google Ireland Ltd) to measure traffic to its pages. This tool is loaded only after you have given your consent via the cookie banner (Article 6(1)(a) of the GDPR and Article 82 of the Loi Informatique et Libertés); you may refuse or withdraw your consent at any time without your browsing being affected.
In the forms, fields marked as mandatory are necessary to process your request; if they are not completed, your request cannot be dealt with. The Site makes no decision based solely on automated processing that produces legal effects concerning you.
Recipients and processors
Your data is intended for the publisher of the Site and is processed on its behalf, within the limits of their respective tasks, by the following service providers:
- IONOS SARL — hosting (servers in France and Germany);
- WooPayments – Stripe — bank card payments;
- Brevo (France) — newsletter and emails to students;
- Google Ireland Ltd — audience measurement, only after consent;
- YouTube (Google) — playback of embedded videos;
- Jetpack / Automattic — testimonial form and sending of the related emails.
Your data is neither sold nor transferred to third parties. It may be disclosed to the authorities where required by law.
Transfers outside the European Union
Hosting (IONOS) and email sending (Brevo) are carried out within the European Union. The services of Google (Analytics, YouTube), Stripe and Automattic may involve transfers to the United States. These transfers are governed by the safeguards provided for in Chapter V of the GDPR: the adequacy decision relating to the EU–US Data Privacy Framework for companies certified under it, or the standard contractual clauses adopted by the European Commission.
Retention periods
- Pre-registrations and student data: for the duration of the relationship, then 3 years;
- Orders and invoices: 10 years (accounting obligation);
- Newsletter: until you unsubscribe;
- Testimonials: until you request their removal;
- Comments: for as long as the article remains published, unless deletion is requested;
- Audience measurement: 14 months at most.
Cookies
Cookies strictly necessary for the operation of the Site are exempt from consent (Article 82 of the Loi Informatique et Libertés). Audience measurement cookies are placed only after you have given your consent via the banner displayed on your first visit; accepting or refusing is equally simple. Your choice is stored for six months and can be changed at any time.
| Cookie | Issuer | Purpose | Duration | Consent |
|---|---|---|---|---|
| pll_language | Site (Polylang) | Remember the chosen language | 1 year | Not required (necessary cookie) |
| Cart and session cookies (WooCommerce) | Site | Manage the cart and the order | Session / 48 h | Not required (necessary cookie) |
| ic_consent | Site | Record your cookie choice | 6 months | Not required (necessary cookie) |
| _ga, _ga_* | Google Analytics | Audience measurement | 13 months at most | Required |
| YouTube cookies | youtube.com | Playback of embedded videos | Set by YouTube | Placed when you start a video (see below) |
Embedded videos are hosted by YouTube: when you start playing a video, YouTube places its own cookies in accordance with Google’s privacy policy. If you do not wish to receive them, do not start playback. You can also configure your browser to refuse cookies, at the risk of impairing certain functions of the Site (language selection, cart).
Your rights
You have the right of access, rectification, erasure, restriction of processing, objection and data portability (Articles 15 to 22 of the GDPR), the right to withdraw your consent at any time (without affecting the lawfulness of processing carried out beforehand) and the right to set out instructions regarding the fate of your data after your death. You may also object at any time, without giving reasons, to receiving our information emails. To exercise these rights, write to idris.devos@institut-imtiyaz.com or to the postal address above; you will receive a reply within one month, and proof of identity may be requested in case of reasonable doubt. You may also lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): https://www.cnil.fr.
Minors
The Site is intended for an adult audience. Pre-registrations and purchases concerning a minor are made by the holder of parental authority. A minor under the age of fifteen cannot consent alone to the processing of their data (Article 45 of the Loi Informatique et Libertés); any data collected without authorisation is deleted on request.
Security and updates
The Site is accessible via HTTPS; bank card details are never stored by the Site, and service providers are contractually bound to process data in accordance with our instructions and to protect it. This policy may be amended; the version in force is the one published on this page. Last updated: September 2026. See also the Legal notice and the Terms of sale.