You are here : Home > Cegos Privacy Policy

Cegos Privacy Policy

Version dated 14/04/2026

Committed to protecting the privacy of its clients, CEGOS undertakes to ensure the protection of personal data.
The purpose of this Policy is to set out our principles and actions aimed at complying with applicable regulations relating to the protection of personal data.
CEGOS may amend this Policy in order to comply with legal or regulatory developments.

1 - Our principles relating to the processing of personal data

Pursuant to Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), the processing of your personal data carried out by CEGOS is based on the following fundamental principles:

  • Processing is lawful, fair and transparent
  • The purposes of each processing activity are specified, explicit and legitimate
  • The data collected is proportionate to the purpose of the processing
  • The data collected is subject to organisational and technical security measures

The personal data collected and processed is carried out by CEGOS SA, a public limited company (société anonyme) with a Management Board and Supervisory Board, with share capital of €5,805,450, registered with the Nanterre Trade and Companies Register under number B 552 024 671, whose registered office is located at 19 rue René Jacques – 92130 Issy-les-Moulineaux, France.
As part of its professional training activities, CEGOS may act either as a data processor or as a data controller, in accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (GDPR).
CEGOS acts as a data processor where personal data is collected from a client acting as employer of the trainee(s), the purpose of employee training being a legal obligation incumbent upon the employer. In this context, CEGOS processes personal data on behalf of this client, acting as data controller, and in accordance with its instructions, within the meaning of Article 28 of the GDPR.
CEGOS acts as a data controller:

  • where the processing of personal data is necessary for compliance with legal and regulatory obligations incumbent upon it as a professional training organisation, in particular for processing such as monitoring the quality of training or retaining supporting documents in the event of inspection by public authorities
  • and where personal data is collected directly from individual customers (natural persons) registering for training on their own behalf. In this context, CEGOS determines alone the purposes and means of the processing. This distinction applies without prejudice to other processing operations for which CEGOS may act as data controller, in particular for commercial prospecting or the improvement of its services

2 - Nature of the data collected

“Personal data” means any information relating to an identified or identifiable natural person, in particular by reference to identifiers such as a name, an identification number, location data, an online identifier, or to one or more specific factors relating to the physical, physiological, genetic, mental, economic, cultural or social identity of that person, as well as any other information that our clients choose to communicate to us.

We mainly collect and process two types of data:

  • Data relating to our clients: this data concerns contacts within training departments, human resources departments and procurement departments. The personal data collected and processed includes surname, first name, email address, job title, postal address, telephone number and any other information voluntarily provided by the individual, provided that its content is relevant and proportionate to the purpose of the processing
  • Data relating to trainees in professional training: this data is collected either from the employer or directly from the trainee at the time of registration. This data includes surname, first name, employer, occupation, training, diplomas and skills, email and postal address, telephone number and any other information voluntarily provided by the individual, provided that its content is relevant and directly related to the purpose of the processing

The collection of trainee data from the employer is based on the employer’s legal obligation to provide training to its employees.

The collection of data directly from the trainee is based on the legal obligation referred to above or on the performance of a professional training action as provided for in Article L.6313-1 of the French Labour Code. The data collected is then necessary for the performance of the training action.

Where applicable, and solely for the purpose of organising meal arrangements during training, CEGOS may request or collect from trainees information relating to possible food allergies.

Likewise, pursuant to Article D.5211-3 of the French Labour Code, CEGOS may collect information relating to potential disability situations in order to provide the necessary adaptations for the training.
The mandatory or optional nature of the data is specified at the time of collection. In the absence of the required data, CEGOS may not be able to process the request or provide the relevant service.

3 - Legal basis for processing

  • The processing of client and trainee data is mainly based on the performance of a contract (registration, training follow-up, issuance of certifications)
  • Certain processing operations are based on a legal obligation (supporting documents to be provided to supervisory authorities, tax obligations)
  • Processing relating to marketing studies, internal statistics or commercial prospecting activities is based on our legitimate interest in developing our activities, unless the data subject objects
  • The collection of specific information (food allergies, disability situations) is based on explicit consent or on the legal obligation to adapt training
  • Where certain processing operations are based on consent, in particular with regard to sensitive data or optional communications (commercial prospecting, newsletters, invitations, etc.), such consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to such withdrawal

4 - Purposes of the collection and processing of personal data

The data collected is processed by CEGOS for the following purposes:

  • Data relating to our clients responsible for purchasing training services is used for the purpose of performing professional training actions for employees. It may also be used for marketing studies, internal statistics and for commercial prospecting activities where the individual has not objected
  • Data relating to trainees is used for registration and processing related to training and certification services, namely: registration management, sending registration confirmations and legal training documents, preparation of attendance sheets, attendance certificates and training certificates, attendance tracking for in-person training, access to online LMS platforms including Learning Hub, and monitoring of training quality. These purposes are defined in accordance with Article L.6353-9 of the French Labour Code
  • The collection of the trainee’s email address may also be used for sending relevant offers or information by CEGOS and its French subsidiaries. The trainee may object to such communications at any time or unsubscribe thereafter

5 - Recipients of personal data

Recipients of personal data are:

  • Internal CEGOS departments responsible for training management. Only personnel authorised to process operations related to training management have access to personal data
  • Subcontractors involved in the provision of services related to the execution of training actions, as well as CEGOS partners (e.g. higher education institutions, universities, certification bodies or other organisations). In such cases, data is processed solely for the purpose of providing the service or enabling access to it
  • Public or private bodies, exclusively for the purpose of complying with legal obligations (in particular monitoring and financing of professional training), as well as legal professionals or debt recovery entities

Where CEGOS transfers personal data to service providers located outside the European Economic Area, it ensures that such transfers are governed by appropriate safeguards in accordance with Articles 44 et seq. of the GDPR, in particular Standard Contractual Clauses or any other recognised protection mechanism.

6 - Data retention period

Personal data collected and processed for the provision of training services is retained for the period strictly necessary for the management of the training. It is then archived until the expiry of the applicable statutory limitation periods.

Data collected for commercial prospecting purposes is retained for a maximum period of three (3) years from the end of the commercial relationship.

Data relating to food allergies or disability situations is retained only for the duration of the training.

7 - Security measures

CEGOS implements technical and organisational measures to ensure the security and confidentiality of personal data, taking into account the nature of the data and the risks associated with processing. These measures include:

  • Access control to premises and IT systems
  • Secure access, sharing and transfer of data
  • Awareness of confidentiality and security requirements among employees
  • Mapping and documentation of processing activities in processing records, regularly updated
  • Regular backup procedures
  • Incident management policy
  • Compliance with data breach notification obligations
  • An Information Security Management System (ISMS), based on a risk-based approach and overseen by a Chief Information Security Officer (CISO)

8 - Rights

In accordance with applicable regulations, you have the right to access and rectify your data, as well as to request its erasure, to object to its processing and to obtain restriction or portability where applicable.

CEGOS may send commercial offers by email to professional clients who have not objected.

Data subjects may unsubscribe from communications relating to offers, news and events at any time using the link provided in each email.

You may contact our Data Protection Officer (DPO):

dpo@cegos.fr

or by post:
DPO / IT Department
19 rue René Jacques
92130 Issy-les-Moulineaux

You also have the right to lodge a complaint with the French Data Protection Authority (CNIL).

9 - Cookies

When browsing the website www.cegos.fr, cookies may be placed on the user’s device.

A cookie is a text file used to recognise a device and collect information relating to browsing activity, in accordance with the user’s preferences.

Types of cookies used

CEGOS uses several categories of cookies:

  • Strictly necessary cookies: These cookies are essential for the proper functioning of the website and for providing the requested services (navigation, access to secure areas, storage of certain settings). They do not require user consent.
  • Audience measurement cookies: These cookies are used to analyse website traffic and to improve its operation and performance.
  • Personalisation cookies: These cookies enable the display of the website and the content provided to be adapted according to the user’s preferences.
  • Advertising and social media cookies: These cookies are used to deliver relevant advertising content and to facilitate content sharing on social media platforms.

Legal basis and consent

Strictly necessary cookies are placed without consent, in accordance with applicable regulations.

Other cookies require the user’s prior consent.

During the first visit, a banner allows the user to:

  • Accept all cookies
  • Refuse non-essential cookies
  • Configure preferences by purpose

These preferences may be modified at any time.

Refusing non-essential cookies does not affect access to the main functionalities of the website.

Third-party cookies

Some cookies may be placed by partners (in particular social networks, analytics tools or advertising providers).

These partners may process data in accordance with their own terms and privacy policies.

Where these partners act on behalf of CEGOS, they act as data processors and such processing is governed in accordance with the applicable regulations.

Retention period

Cookies subject to consent are retained for a maximum period of thirteen (13) months. The choices expressed by the user are retained for a maximum period of six (6) months. Additional information on the cookies used is available via the cookie management module accessible on the website.


In case of any discrepancy, the French version shall prevail.