Privacy policy
Last updated: May 2026 — GDPR compliant (EU 2016/679)
1. Data controller
Institut Evolution, SAS — SIRET 902 842 632 00017
30 Rue Franklin, 93120 La Courneuve, France
GDPR contact: contact@institutevolution.com
(subject: "GDPR rights request")
2. Data collected and purposes
We only collect data strictly necessary for our activities:
| Data collected | Purpose | Legal basis |
|---|---|---|
| Email, surname, first name (free guide form) | Sending the free guide, communication about our courses | Consent (explicit opt-in) |
| Name, email, phone (Brevo Meetings booking) | Handling the training request, educational follow-up | Legitimate interest / pre-contract |
| Browsing data (GTM / GA4 cookies) | Anonymised statistics, site improvement | Consent (cookie banner) |
We never sell, rent or share your data with third parties for commercial purposes.
3. Retention periods
- Contacts (form / newsletter): until unsubscribe or 3 years of inactivity
- Learner data: duration of the course + 5 years (Qualiopi / DREETS obligation)
- Analytics data (GA4): 14 months
- Connection logs: 12 months (legal obligation)
4. Cookies
This site uses Google Tag Manager (GTM-5WXPFTF9) to measure audience via Google Analytics 4. These cookies are only set after your explicit consent via the cookie banner displayed on your first visit.
You can withdraw your consent at any time by clicking "Manage cookies" at the bottom of each page, or via your browser settings.
5. Your rights
In accordance with the GDPR, you have the right to access, rectify, erase, port and object to the processing of your data.
To exercise these rights: contact@institutevolution.com — subject: "GDPR rights request".
Response time: 30 days.
In the event of a dispute, you may lodge a complaint with the CNIL (French Data Protection Authority).
6. Processors
We use the following processors to handle your data:
| Brevo | Transactional emailing, appointment booking — DPA included in Brevo's terms — EU hosting |
| SmartOF | Learner and training file management — signed processing agreement — France hosting |
| Google Tag Manager and Google Analytics 4 — DPA included in Google's terms — non-EU transfer framed by standard contractual clauses (SCC) | |
| Cloudflare | Website hosting and CDN — DPA included in Cloudflare's terms — non-EU transfer framed by SCC |
7. Security
Institut Evolution implements the appropriate technical and organisational measures to protect your data against any unauthorised access, loss or disclosure: HTTPS (TLS) encryption, restricted data access, regular review of permissions.
8. Changes
This policy may be updated. The date of the last change is indicated at the top of the page. In the event of a substantial change, we will inform you by email if you are subscribed to our newsletter.
9. Contact
For any questions regarding your data: contact@institutevolution.com
See also our Legal notice.