Privacy Policy
irice-certification.com
Last updated: 03/08/2026
1. Preamble
This policy informs users of the irice-certification.com website (hereinafter "the Website") about the processing of personal data carried out in connection with their browsing and their requests.
2. Data controller
The controller of the data collected through the Website is:
- IRICE, simplified joint-stock company with a share capital of €20,000
- Aix-en-Provence Trade and Companies Register No. 835 324 112
- Registered office: 10 rue du Lieutenant Parayre, Espace Wagner Building A2, 13290 Aix-en-Provence, France
- Functional contact address: hello@irice-certification.com
IRICE is a company of the NORMAXIS group. The processing described below is carried out on behalf of IRICE, in its capacity as a certification body, and not on behalf of the group.
3. Data Collected
The following data may be collected on the Website:
- Identification data: surname, first name, position, organisation, email address, telephone number
- Certification-related data: project information, site address, technical documents
- Browsing data: IP address, browser type, consultation time, pages visited (via cookies)
IRICE collects only the data strictly necessary for the purpose of the processing.
4. Purposes and legal bases
| Processing | Legal basis |
|---|---|
| Responding to enquiries submitted through the contact form | Legitimate interest of IRICE in responding to enquiries addressed to it |
| Handling a certification request, an assessment request or a training registration | Performance of a contract or pre-contractual measures |
| Retention of certification files and associated records | Legal obligation and accreditation requirements (ISO/IEC 17065; Cofrac accreditation No. 5-0655 · Certification of products, processes and services · ISO/IEC 17065 · Scope available on www.cofrac.fr) |
| Sending regulatory or methodological information | Consent of the data subject |
| Website audience measurement | Legitimate interest, under a consent-exempt configuration (anonymised measurement, no cross-site matching) |
| Fraud prevention and Website security | Legitimate interest of IRICE |
IRICE does not sell, rent or exchange any personal data.
5. Retention periods
- Enquiries without contractual follow-up: 3 years from the last exchange.
- Certification files and associated records: for the duration of the certification cycle, then archived for the period required by the applicable accreditation rules.
- Training files: for the period required by French vocational training regulations and by the funding bodies.
- Audience measurement data: 13 months maximum.
- Accounting records: 10 years, in accordance with the French Commercial Code.
6. Recipients and processors
Data is processed by authorised IRICE personnel. It may be disclosed to the following processors, each bound by a contract compliant with Article 28 GDPR:
- OVH SAS (2 rue Kellermann, 59100 Roubaix, France), website hosting, on a server located in France.
- Infomaniak Network SA (Switzerland), email and domain names.
- Hetzner Online GmbH (Germany), backups.
- Matomo, on a self-hosted instance operated by the NORMAXIS group on its own server, audience measurement. No audience data is transmitted to any third party or external analytics vendor.
- mosparo, on a self-hosted instance operated by the NORMAXIS group, anti-spam protection of public forms.
- The companies of the NORMAXIS group that operate the shared technical tools and handle incoming requests on behalf of IRICE.
Data may be disclosed to a judicial or administrative authority within the limits set by law.
7. Transfers outside the European Union
The website data is hosted in France, and its backups are kept in Germany, within the European Union. Emails exchanged with IRICE are handled by its email provider in Switzerland, a country recognised by a European Commission adequacy decision as providing an adequate level of protection. No other transfer outside the European Union takes place. Should this change, this policy would be updated and the appropriate safeguards specified.
8. Security
IRICE implements appropriate technical and organisational measures (encryption of data in transit, named access control, logging, backups) to protect data against loss, alteration, unauthorised access or disclosure.
9. Exercising your rights
Under the GDPR, every data subject has a right of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions concerning the fate of their data after death.
These rights may be exercised at the functional address hello@irice-certification.com, or by post to IRICE SAS, 10 rue du Lieutenant Parayre, Espace Wagner Building A2, 13290 Aix-en-Provence, France. Proof of identity may be required. IRICE responds within one month at the latest.
A complaint may be lodged with the French data protection authority, the CNIL.
The right to erasure does not apply to records whose retention is required by accreditation rules or by a legal obligation, for the duration of that obligation.
10. Cookies and audience measurement
The Website sets cookies strictly necessary for its operation, together with the trackers of the self-hosted Matomo instance described in section 6, configured in consent-exempt mode (IP anonymisation, no cross-site matching, no transmission to third parties). Preferences can be managed at any time from the browser.
11. Policy updates
This policy may be amended to reflect regulatory or technical developments. The applicable version is the one published online at the date of browsing.