Privacy Policy
irice-certification.com
Last updated: 03/08/2026
1. Preamble
This policy informs users of the irice-certification.com website (hereinafter "the Website") about the processing of personal data carried out in connection with their browsing and their requests.
2. Data controller
The controller of the data collected through the Website is:
- IRICE, simplified joint-stock company with a share capital of €20,000
- Aix-en-Provence Trade and Companies Register No. 835 324 112
- Registered office: 10 rue du Lieutenant Parayre, Espace Wagner Building A2, 13290 Aix-en-Provence, France
- Functional contact address: contact@irice-certification.com
IRICE is a company of the NORMAXIS group. The processing described below is carried out on behalf of IRICE, in its capacity as a certification body, and not on behalf of the group.
3. Data Collected
The following data may be collected on the Website:
- Identification data: surname, first name, position, organisation, email address, telephone number
- Certification-related data: project information, site address, technical documents
- Browsing data: IP address, browser type, consultation time, pages visited (via cookies)
IRICE collects only the data strictly necessary for the purpose of the processing.
4. Purposes and legal bases
| Processing | Legal basis |
|---|---|
| Responding to enquiries submitted through the contact form | Legitimate interest of IRICE in responding to enquiries addressed to it |
| Handling a certification request, an assessment request or a training registration | Performance of a contract or pre-contractual measures |
| Retention of certification files and associated records | Legal and regulatory obligation (ISO/IEC 17065 requirements and Cofrac accreditation No. 5-0655) |
| Sending regulatory or methodological information | Consent of the data subject |
| Website audience measurement | Legitimate interest, under a consent-exempt configuration (anonymised measurement, no cross-site matching) |
| Fraud prevention and Website security | Legitimate interest of IRICE |
IRICE does not sell, rent or exchange any personal data.
5. Retention periods
- Enquiries without contractual follow-up: 3 years from the last exchange.
- Certification files and associated records: for the duration of the certification cycle, then archived for the period required by the applicable accreditation rules.
- Training files: for the period required by French vocational training regulations and by the funding bodies.
- Audience measurement data: 13 months maximum.
- Accounting records: 10 years, in accordance with the French Commercial Code.
6. Recipients and processors
Data is processed by authorised IRICE personnel. It may be disclosed to the following processors, each bound by a contract compliant with Article 28 GDPR:
- Infomaniak Network SA (Switzerland) — Website hosting and email.
- Matomo, on a self-hosted instance operated by the NORMAXIS group on its own server — audience measurement. No audience data is transmitted to any third party or external analytics vendor.
- mosparo, on a self-hosted instance operated by the NORMAXIS group — anti-spam protection of public forms.
- The companies of the NORMAXIS group that operate the shared technical tools and handle incoming requests on behalf of IRICE.
Data may be disclosed to a judicial or administrative authority within the limits set by law.
7. Transfers outside the European Union
Data is hosted in Switzerland, a country recognised as providing an adequate level of protection by a decision of the European Commission. No other transfer outside the European Union takes place. Should this change, this policy would be updated and the appropriate safeguards specified.
8. Security
IRICE implements appropriate technical and organisational measures (encryption of data in transit, named access control, logging, backups) to protect data against loss, alteration, unauthorised access or disclosure.
9. Exercising your rights
Under the GDPR, every data subject has a right of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions concerning the fate of their data after death.
These rights may be exercised at the functional address contact@irice-certification.com, or by post to IRICE SAS, 10 rue du Lieutenant Parayre, Espace Wagner Building A2, 13290 Aix-en-Provence, France. Proof of identity may be required. IRICE responds within one month at the latest.
A complaint may be lodged with the French data protection authority, the CNIL.
The right to erasure does not apply to records whose retention is required by accreditation rules or by a legal obligation, for the duration of that obligation.
10. Cookies and audience measurement
The Website sets cookies strictly necessary for its operation, together with the trackers of the self-hosted Matomo instance described in section 6, configured in consent-exempt mode (IP anonymisation, no cross-site matching, no transmission to third parties). Preferences can be managed at any time from the browser.
11. Policy updates
This policy may be amended to reflect regulatory or technical developments. The applicable version is the one published online at the date of browsing.