Privacy policy, cookies and your rights

Last updated: 9 October 2026. This English version is provided for convenience; the French version prevails.

This policy explains which personal data MYPASCHOOL collects on https://mypaschool.fr, why, how long it is kept and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

MYPASCHOOL, SASU with a share capital of €500, 5 rue du Clos des Peupliers, 58240 Langeron, France, Nevers Trade and Companies Register 909 137 044, represented by Yvon-Patrick Mamia, President. Contact for any question about your data: contact@mypaschool.fr.

2. Data collected and purposes

Account (name, email address, encrypted password, language): to create and secure your account. Legal basis: performance of the contract.
Orders (name, email, delivery address and phone for print books, order details and amount, promo code and, where applicable, the partner who recommended the course): to sell and deliver courses and books, invoice and handle refunds. Your bank details are never received or stored by MYPASCHOOL: they are entered with the payment provider. Legal basis: performance of the contract and accounting obligations.
Training records (enrolments, positioning questionnaire, progress, learning time measured on lesson pages, login log with irreversibly encrypted IP address, quizzes, personal notes, questions to the trainer, certificates, certificate of achievement, satisfaction and drop-out surveys): to deliver the training, issue the certificate of completion (article L.6353-1 of the French Labour Code) and improve our courses. Legal basis: performance of the contract and legal obligations of a training organisation.
Adjustment needs (optional answer in the positioning questionnaire, which may reveal a disability): to work out adjustments to the course with you. This information is read only by the trainer and the disability officer; you can ask for it to be deleted at any time. Legal basis: your explicit consent, by providing it.
Partner programme (first name, last name, email address, phone, optional company and SIRET number, description of your activity, assigned promo code, sales made with that code and commissions, bank details — account holder and IBAN — that you enter yourself in your partner area): to review your application, manage your code, calculate and pay your commissions, and meet our accounting and tax obligations (reporting commissions to the tax authorities where required by law). Legal basis: performance of the partnership contract and legal obligations. When you buy with a partner's code, the partner only sees the course, the date and the amount of the sale, never your identity.
Live sessions (registration, reminder): to send you the joining link and a reminder. Legal basis: performance of your request.
Messages (contact form, appointment request, complaint, blog comment): to reply and handle your request. Legal basis: legitimate interest and obligations of a training organisation (complaint handling).
Newsletter (email address, double opt-in): to keep you informed of our news. Legal basis: your consent, which you can withdraw at any time using the link in every email.
Security (technical logs, IP address irreversibly hashed for forms): to prevent abuse and fraud. Legal basis: legitimate interest.

3. Recipients and processors

Your data is intended for MYPASCHOOL and is never sold. It is shared, only as strictly necessary, with the following providers:

OVH (France): hosting of the website, database and emails;
Stripe, SumUp and PayPal: online payment, depending on the method chosen;
Vimeo: course video streaming;
Google (YouTube, Google Meet, Google Calendar): video replays and live session rooms;
La Poste: delivery of print books;
Amazon: only if you choose to buy a book on Amazon (you then leave the website);
Our bank: transfer of commissions to partners;
The French tax authorities: reporting of commissions paid to partners, where required by law.

Some of these providers may process data outside the European Union (in particular in the United States). These transfers are covered by the safeguards provided for by the GDPR (adequacy decision, European Commission standard contractual clauses).

4. Retention periods

Account: while active, then 3 years after the last activity;
Orders and accounting records: 10 years (article L.123-22 of the French Commercial Code);
Training records (enrolment, positioning, progress, learning time, logins, certificate, assessments): 6 years after the end of the course, for audits and funding bodies;
Messages, appointment requests and complaints: 3 years after the last exchange;
Newsletter: until you unsubscribe;
Partner programme: unsuccessful application, 1 year (deleted automatically); partner, for the whole partnership then 3 years; bank details, until the end of the partnership; commissions and transfers, 10 years as accounting records;
Technical logs and security data: 12 months at most.

5. Cookies

The website uses no advertising or audience measurement cookies. It only sets technical cookies that are essential for it to work (session, form security, staying signed in if you ask for it), which do not require your consent. When you arrive through a partner's link, their promo code is only kept for the duration of your visit so it can be pre-filled at checkout: no tracking cookie is set.

Embedded videos are loaded in privacy-friendly mode (Vimeo without tracking, YouTube in “privacy-enhanced” mode); the video service may nevertheless record technical information when you start playback.

6. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions regarding your data after your death. You can update your details from “My profile” in your account, and exercise your rights by writing to contact@mypaschool.fr or to the registered office. You will receive a reply within one month.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris, France, www.cnil.fr).

7. Security

Exchanges with the website are encrypted (HTTPS), passwords are stored irreversibly encrypted, partners' bank details are encrypted in the database, access to the administration requires two-factor authentication, and private files (ebooks, course resources) are only accessible to authorised people.

8. Changes to this policy

This policy may be updated; the date of the last update appears at the top of the page.

A question about our privacy policy?

To exercise your rights or ask a question about this privacy policy, contact us. You can also read our legal notice and our terms of sale. Finally, if you believe your rights are not respected, you can contact the French data protection authority (CNIL).