Privacy Policy

1. Data we collect

• Identity: surname, first name, date and place of birth, nationality;
• Contact details: e-mail address, phone number, also used on WhatsApp to follow up on your request;
• Study project: study city, field of study, length of stay, estimated arrival date;
• Exchanges with our support: the content of your messages in the site chat and of our replies, linked to your account when you are signed in or when you create your account during the same visit;
• Account: password (hashed), order history;
• Payment: processed directly by our provider Stripe — we do not store your card number;
• Browsing data: see the Cookie Policy.

2. Purposes and legal bases

• Issuing and managing the Certificate (performance of the contract);
• Creating and managing the client account (performance of the contract);
• Payment collection and fraud prevention (performance of the contract, legitimate interest);
• Support and follow-up on your request, by e-mail, phone or WhatsApp on the number you provided, including helping you complete an interrupted request (performance of the contract and pre-contractual steps taken at your request, legitimate interest in following up a request you started); you may ask for these contacts to stop at any time;
• Answering your questions in the site chat and improving the quality of those answers by reviewing the exchanges (legitimate interest);
• Commercial communications and promotional campaigns (consent, withdrawable at any time);
• Certificate authenticity verification via QR code (legitimate interest);
• Accounting and tax obligations (legal obligation).

3. Recipients

Data is accessible to authorised teams of Colonies and its processor Cozac Conseil, and to our providers: Stripe (payment), the site host, e-mailing tools and, where applicable, the agency in charge of acquisition campaigns. No data is sold to third parties.

4. Transfers outside the European Union

Some providers may process data outside the EU. In that case, transfers are governed by appropriate safeguards (European Commission standard contractual clauses or an adequacy decision).

5. Retention periods

• Account and order data: duration of the contractual relationship, then archived for 5 years (limitation period);
• Exchanges with support, including the site chat: 13 months;
• Accounting records: 10 years;
• Prospecting data: 3 years after last contact;
• Cookies: see the Cookie Policy.

6. Your rights

You have rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw consent at any time. To exercise them, contact us via the WhatsApp hotline or at the address given in the legal notice. You may also lodge a complaint with the CNIL (cnil.fr).

7. Security

Data is hosted in the European Union and protected by appropriate technical and organisational measures (encryption in transit, access control, logging).