Personal data protection policy

Last update: 25 May 2026

The ORSYS Group (ORSYS Formation, ORSYS Institut, ORSYS Belgium, ORSYS Luxembourg, ORSYS Switzerland, ITTCert) is concerned about the protection of its customers' personal data. It undertakes to ensure the best level of protection in compliance with European and French regulations applicable to it in terms of personal data protection.

For all information on the protection of personal data, you can also consult, depending on your situation :

the Commission Informatique et Liberté website www.cnil.fr in France
the Data Protection Authority website www.autoriteprotectiondonnees.be in Belgium
the National Data Protection Commission website www.cnpd.lu in Luxembourg
the website of the Federal Data Protection and Information Commissioner www.leprepose.ch in Switzerland

What are our principles for processing personal data?

In accordance with current regulations, the processing of your personal data carried out by ORSYS Group is based on the following principles:

The data collected is proportional to the purposes of the processing.
The purposes of each processing are determined, explicit, and legitimate.
The processing is lawful, fair, and transparent.

The data collected are subject to organisational and technical security measures.

Who is responsible for processing my personal data?

The data controller is the company that determines how and for what purpose your personal data are used.

For personal data collected on our websites and mobile applications, or during your contacts with our sales teams (needs analysis, orders, follow-up of files, etc.), the data controller is:

ORSYS GROUP

1 Parvis de la Défense,

La Grande Arche Paroi Nord

92044 PARIS LA DÉFENSE CEDEX

RC Nanterre: 482 761 160

Why does the ORSYS group collect my personal data ?

The ORSYS group uses your personal data mainly for the following purposes:

Managing training orders and customer relations, ensuring that training courses are actually delivered
The vast majority of our customers are private companies and public bodies, and some are private individuals. We need information about you to manage professional training orders placed by your employer or yourself, and to follow up on these orders.
For example registering for an inter- or intra-company training session or an e-learning session; sending out your invitations or your login details for our LMS (Learning Management System) platform; welcoming you to our centres and training rooms; checking the registration procedures (pre-requisite test); carrying out the training service and monitoring the training periods completed; assessing knowledge; organising registrations for certification exams; monitoring customer relations, such as carrying out satisfaction surveys; managing complaints and after-sales service.

The personalisation of our services and the messages we send you
We use your data to improve the services we offer you and the communications we send you. For example, we can send you personalised emails or recommend training courses that correspond to your professional needs.

Customer knowledge, statistics, and performance of our site
We may use anonymous data to analyse activity on our site and improve the services we offer. For example, we measure the number of pages viewed, the number of visits to the site, visitor activity and the frequency with which visitors return.
We may use the data concerning you to establish internal statistics linked to your commercial relationship with the ORSYS group.

What personal data is collected about me?

What data?

Customers and training providers (contacts in the training department, human resources department, buyers, operational directors and managers, etc.)

The personal data collected and processed are mainly: surnames, first names and professional details (company, job title, postal address, e-mail address, telephone number), some connection data, order history, and any other information provided spontaneously if its content is relevant and proportional to the purpose of the processing.

Participants in ORSYS Group training courses

Personal data is collected either from the employer or from the participant when registering. It mainly consists of: surname, first name, professional details (employer's name, profession, postal address, email address, telephone number), Curriculum Vitae (compulsory in the context of training financed by the CPF), some connection data, evaluations of training courses attended, self-assessments of knowledge acquisition, and any other information provided spontaneously if its content is relevant and proportional to the purpose of the processing.

The collection of the participant's data from the employer meets the legal training obligation of employers towards their employees.

The collection of data from the participant him/herself fulfils the legal obligation referred to in the previous paragraph or the performance of a vocational training action as provided for in article L 6313-1 of the French Labour Code. The data collected is then necessary to carry out the action.

Where applicable, in application of article D 5211-3 of the French Labour Code, the ORSYS Group may collect information on any disability in order to provide the necessary adaptations to the course. This information is only kept until the end of the training course. It is then removed from our systems and we keep no trace of it.

When?

For the training providers (contacts in the training department, human resources department, buyers, operational directors and managers, etc.), we collect the information provided when :

You request the creation of an account in our customer area.
You place an order on one of our websites or with our sales teams (email or web forms).

For people taking ORSYS Group training courses, we collect the information provided when:

You are using an account MyOrsys to access the educational resources of a training course you have attended.
You evaluate a training course you have attended.
You browse our websites and consult our training products.
You contact our Customer Service.

For all, we collect the information provided when:

You submit an information request.
ou send us a registration request for one of our free events. During online collection, the mandatory or optional nature of the data is indicated to you by an asterisk.

When data is collected online, the compulsory or optional nature of the data is indicated by an asterisk.

The ORSYS group may also collect data from prospective customers in the context of:

Purchase of data via external partner databases, in compliance with the GRPD.
Professional events (trade fairs and webinars): the data collected includes surnames, first names and professional contact details (company, job title, postal address, e-mail address, telephone number).
In both cases, an acknowledgement of receipt is sent to the e-mail address collected to inform you of our approach and give you the immediate opportunity to object.

Subscription to our "blog" content: our prospects can ask to receive our commercial e-mails, based on the training topics that interest them. They are then invited to enter their professional e-mail address and simply select the content categories to which they would like to subscribe.

What communications am I likely to receive?

Service emails

Following an order or registration for online training or as part of the management of a contract, you will receive e-mails enabling you to track your order or the progress of your online training or the execution of your contract (confirmation of orders, organisation of training, access link to the online training platform, reminder and end of online training notifications, retrieval of administrative documents, etc.).

These service messages are necessary for the proper execution of the orders and services you have requested. Receiving this information is not linked to the choices you will have expressed for receiving communications for commercial purposes.

Commercial emails and newsletters

As a customer, if you have not objected, or as a prospect (trade show, webinar, blog, etc.), you may receive information and offers from ORSYS by email. These messages keep you informed about ORSYS's news, the evolution of its training offer, session availability, and events (presence at trade shows, conferences, or webinars). We systematically measure the open rate and click-through rate of these emails to adapt them as closely as possible to your needs.

Postal mailings

If you have not objected, you may receive offers and information by post.

On what legal basis and for how long is my personal data processed?

The processing of your personal data is justified on different grounds (legal basis) depending on the use we make of the personal data. You will find below the legal bases and retention periods that we apply to our main processing operations.

Legal bases of the processing Among the applicable legal bases:

Contract: the processing of personal data is necessary for the performance of the contract to which you have consented.
Consent: you agree to the processing of your personal data through express consent (checkbox, email contact, or telephone contact with your ORSYS sales representative). You can withdraw this consent at any time.
Legitimate interest: ORSYS gorup has a commercial interest in processing your data that is justified, balanced, and does not infringe on your privacy. Except in exceptional cases, you can oppose a processing based on legitimate interest at any time by notifying ORSYS.
Legal obligation: the processing of your personal data is mandatory by law.

Retention periods

Most data (information from your customer account, order history, etc.) is kept for as long as you are an "active" customer and for a period of 5 years after your last activity. Your data is then archived with restricted access for a further period for limited purposes authorised by law (payment, requests for old documents such as a training certificate or diploma, etc.). After this period, the data is deleted.

Purpose of processing	Legal basis	Shelf life in operational base	Archiving	Useful comments
Management of registrations for training courses or associated services	Contract	the contract period	5 years from the end of the contract	A customer is active, for example, when he or she registers for one of his or her colleagues, takes a training course, meets one of our sales staff or logs on to his or her account.
Management of prerequisite tests	Legitimate interest	time for assessment	5 years from the valuation date	Assessment of candidates to determine whether they have the level required to follow the courses
Managing registrations for certification exams	Contract	the contract period	5 years from the end of the contract	A customer may request to take a certification exam with a training partner or a publisher. In both cases, the third party recipient has its own RGPD policy, which is available on request, and undertakes to use our Participants' data solely for the purposes of organising the training course or certification requested.
Website management	Legitimate interest	the time it takes to process the request
Use of the Espace Pro account (for prescribers) or MyOrsys (for participants)	Contract	5 years from last activity	5 to 10 years	A prescriber customer is active, for example, when they make a purchase, retrieve administrative documents or log into their Espace Pro account. A participating customer is active when they have taken a training course or logged into their user account (MyOrsys).
Prospect management	Legitimate interest	3 years from last activity	5 years from the end of the contract	As part of the management of your client account, you may receive paper or electronic communications from ORSYS concerning its products or services. You may oppose this at any time.
Sending B2B messages by email (electronic commercial prospecting) by ORSYS	Legitimate interest	3 years from last activity	N/A	As part of the management of your customer account, you may receive electronic communications from ORSYS concerning its products or services. You can oppose to it as of the creation of the account then constantly.
Sending of B2C messages by e-mail (electronic commercial prospecting) by ORSYS	Consent	3 years from last activity	N/A	As part of the management of your client account, you may receive electronic communications from ORSYS concerning its products or services. You may withdraw your consent at any time.
Sharing of data within the ORSYS group for customer knowledge purposes	Legitimate interest	5 years from last activity	5 to 10 years	You may indicate at any time your opposition to the sharing of information within the ORSYS group by post or e-mail.
Survey of opinions (training courses attended) by ORSYS	Legitimate interest	5 years from last activity	5 years from last activity	As part of the quality monitoring of your training purchase, you may receive electronic communications from ORSYS concerning its brand, products or services;
Opinion management platform operated by a specialist subcontractor (Avis Vérifiés)	Legitimate interest	18 months from last activity or 3 months if no activity	18 months maximum	As part of the quality monitoring of your training purchase, you may receive electronic communications from ORSYS or Avis Vérifiés (Skeepers group) concerning its brand, products or services.
Opinion on the ORSYS Google school file	Consent	Google Privacy Policy	Google Privacy Policy	Reviews submitted via your account on the ORSYS Google business page are managed in accordance with the Google Privacy Policy.

What measures have been taken to secure my data?

The ORSYS Group takes technical and organisational measures to prevent unauthorised access or disclosure of data:

Access to our premises and IT environments is secure.
Access, sharing and transfer of data are secure.
Our employees who have access to personal data are trained in confidentiality requirements.

Who will receive my data?

Transmission of data to subcontractors

The data collected may be transmitted to service providers (subcontractors) used by the ORSYS Group to carry out its training courses in the context of the purposes mentioned above, mainly in the context of the actual carrying out of synchronous or asynchronous training courses (support in the context of the tutoring option on the e-academy.orsys.fr platform, invoicing of licences to partners who publish off-the-shelf content). ORSYS also calls upon service providers specialised in the management of customer satisfaction surveys and opinions, such as the Avis Vérifiés platform (SKEEPERS group), acting as a subcontractor on behalf of ORSYS. In this context, only strictly necessary data is transmitted to the service providers concerned, in accordance with ORSYS' instructions.

Transmission of data to training coordinators

The data we collect may be shared with training coordinators for the purposes mentioned above, primarily in connection with the delivery of asynchronous training courses (connection status, progress status).

Data sharing within the ORSYS Group

Your data may also be transmitted to other ORSYS Group subsidiaries for research and customer knowledge purposes. To find out the current list of group entities likely to receive your data, you can make a request.

Sharing data with third parties

The ORSYS Group only shares your data with service providers necessary for the delivery of its training courses and satisfaction surveys.

Following a satisfaction survey conducted via our service provider Avis Vérifiés (SKEEPERS Group), you may choose — on an optional basis — to continue the process by submitting a public review on the ORSYS establishment listing available on Google. In this case, although the review contributes to ORSYS’s visibility, the Google platform acts on its own behalf, as an independent data controller or joint controller, in accordance with the terms defined by Google. Google determines its own purposes (publication, indexing, moderation, public display of reviews) and its own processing methods.

ORSYS has no control over either the operation of the Google platform or the processing carried out by Google on the published reviews.

For more information on the processing carried out by Google when you submit a review, please consult Google's Privacy Policy, available at the following address: https://policies.google.com/privacy.

How can I express my choices about the use of my data?

You may withdraw your consent or object to the use of your data at any time:

By e-mail to rgpd@orsys.fr
By post to : ORSYS, Personal Data Processing, 1 parvis de la Défense, La Grande Arche, Paroi Nord, 92044 Paris La Défense.
In your customer area if you have an account (for training providers) or in your MyOrsys area (for participants in our training courses).

All our advertising emails contain an unsubscribe link allowing you to unsubscribe from our communications at any time.

What rights do I have regarding the use of my personal data?

In accordance with the regulations on the protection of personal data, you can exercise your rights (access, rectification, deletion, opposition, limitation and portability where appropriate) by writing to rgpd@orsys.fr or by post to ORSYS, Processing of personal data, 1 parvis de la Défense, La Grande Arche, Paroi Nord, 92044 Paris La Défense.

To enable us to respond quickly, please indicate your surname(s)/first name(s), company, professional e-mail address used in your relationship with ORSYS, as well as the desired modification. Certain requests to exercise your rights (right of access) must be accompanied by a photocopy of an identity document bearing your signature in order to verify your identity and specify the address to which the reply should be sent. A reply will be sent to you within one month of receipt of the request.

You also have the right to lodge a complaint with the Commission responsible for personal data protection in your country.

The ORSYS Group has a Personal Data Protection Officer (DPO) responsible for guaranteeing the protection of personal data. You can contact him at the following address dpo@orsys.fr (excluding exercise of your rights, which can be exercised mainly at the following address rgpd@orsys.fr).

Is my data transferred outside the European Union?

Your personal data is, in principle, hosted and processed within the European Union (EU) and the European Economic Area (EEA). However, for certain specific purposes (measuring traffic on our websites, online advertising and measuring the effectiveness of our campaigns, as well as sharing data within our group), your data may be processed by service providers or entities located outside the EU/EEA, in particular in the United States, Canada and Switzerland. Where such a transfer takes place, we ensure that it is governed by one of the safeguards provided for in the General Data Protection Regulation (Articles 44 et seq.):

an adequacy decision by the European Commission, which recognises that a country provides a level of protection equivalent to that of the EU (this is the case with Switzerland and, for commercial organisations, Canada);
the EU-US Data Privacy Framework, for US companies that have signed up to it;
failing that, the standard contractual clauses adopted by the European Commission, supplemented if necessary by additional protective measures.

The main recipients concerned are as follows:

Recipient	Country	Purpose	Guarantee for the transfer
ORSYS Group entities (in particular ORSYS Switzerland)	Switzerland	Intra-group sharing for customer knowledge purposes	Suitability decision (Switzerland)
Google (Google LLC)	United States	Audience measurement (Analytics), advertising and conversion measurement (Ads), opinion management	Data Privacy Framework + standard contractual clauses
Microsoft	United States	Advertising (Bing), usage analysis (Clarity)	Data Privacy Framework + standard contractual clauses
Meta (Facebook, Instagram)	United States	Targeted advertising and retargeting	Data Privacy Framework + standard contractual clauses
LinkedIn	United States	Advertising and retargeting	Data Privacy Framework + standard contractual clauses
Dialog Insight	Canada	Identification of visitors to our e-mails	Suitability decision (Canada, commercial organisations)

Special case of measuring our advertising

When you fill in a form on our site (for example a request for a quote or a registration), we may, with your consent, transmit your e-mail address and/or your telephone number to Google in an encrypted and unreadable form, in order to measure the effectiveness of our advertising campaigns. This information may then be processed by Google in the United States, under the conditions described above. You can obtain a copy of the guarantees put in place for these transfers by writing to us at the following address rgpd@orsys.fr.

What about the personal data of minors?

The ORSYS group's services are not intended for minors, consequently the ORSYS group does not process data specifically concerning minors.

What types of cookies are used?

ORSYS Group websites use cookies or similar technologies to improve your browsing experience or to offer you personalised advertising content.

We rely on a trusted third party, Axeptio, which manages the collection and storage of your consent.

Our customers and prospects can manage their consents independently, via a window accessible at the bottom of each page of our websites. They can, as they wish and at any time, accept or refuse each of the types of cookies below:

Cookies used to track website statistics or browsing behaviour on our websites (Google Analytics, Hotjar, etc.)
Cookies used to measure the effectiveness of sponsored campaigns (Google Ads, Bing, Facebook, Twitter, Instagram, etc.)
Cookies used to identify visitors to our promotional emails (Dialog Insight).