Privacy policy

Introduction

Y SCHOOLS Troyes Association, a French association governed by the French Law of 1st July 1901, registered under SIREN number 107 057 663, with its registered office at 217 avenue Pierre Brossolette, 10000 Troyes, France (“Y SCHOOLS”, “we”, “us” or “our”), respects your privacy and we are committed to protecting your personal data. A reference to Y SCHOOLS includes SCBS – South Champagne Business School, École Supérieure de Design, and l’Ecole Supérieure de Tourisme.

This Privacy Policy describes how we collect and process your personal data when you visit or use www.scbs-education.com (our “Website”), as well as when you register an account with us, and when you contact us or interact with us online or via telephone.

This Website is not intended for children under 15 years of age and we do not knowingly collect data relating to children under 15 on this Website without the consent of the holder of the parental authority.

Important information and who we are

Data controller

For the purposes of data protection laws, we are the “controller” of the processing of your personal data. This means that we decide why and how your personal information is processed. It also means that we are responsible to you under the law for that processing.

Y SCHOOLS Troyes Association is registered in France under registration SIREN number SIREN 107 057 663 and registered office at 217 avenue Pierre Brossolette, 10000 Troyes, France.

We are part of a group of companies made up of different legal entities, details of which can be found here https://www.globaluniversitysystems.com/our-network

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Email address: dpo@yschools.fr
Postal address: Y SCHOOLS Troyes – DPO, 217 avenue Pierre Brossolette, 10000 Troyes, France
Telephone number: +33 3 25 71 22 22

Changes to the privacy policy and our duty to inform us of changes

This version was last on the date stated at the end of the policy, and historic versions can be obtained by contacting us.

We may from time to time change the detail in this policy. Any changes we may make in the future will be posted on this page. Please check back frequently to see any such updates or changes.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy notice of every website you visit.

Types of personal information we collect

When you visit our Website, we collect, use and store different types of personal information about you, which we have grouped together as follows:

Types of Personal Information	Description
Identity and Contact Data	Name, title, date of birth, address, type of address (e.g. home, second home, work), email address and telephone numbers
Application and Course Data	Program applied for or enrolled in, application file, correspondence, admission status, information necessary for enrolment
Transaction Data	Bank account and payment card data, details about payments to and from you, other details of products and services purchased from us. We do not retain full credit card data when payment is processed by a dedicated payment service provider
Account Data	Your username and password, your interests, preferences and any feedback/survey responses
Voice Data	Your voice from call recordings when you contact our Customer Services team by phone and where individuals are informed of such recording.
Publicly Available Data	Details about you that are publicly available, such as on Companies House or elsewhere on the internet, where their use is relevant and lawful.
Marketing Data	Details about your preferences in receiving marketing communications from us
Consents Data	Any permissions, consents or preferences that you give us
Usage Data	Information about how you use our Website, products and services, including usage reports, call summaries and field reports when you contact us by phone and generated by our service provider (see below for further details).
Technical Data	IP address, login data, browser type, time zone setting and location, browser plug-in types, operating systems, device ID and other technology on your device.

We do not request sensitive data (such as health data, racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, or data concerning sex life or sexual orientation), except where strictly necessary, for example in order to consider a request for accommodation related to a disability. In such cases, enhanced protective measures are applied.

How we use your information

Cookies

Our Website uses cookies and other similar technologies. As you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. For more information on our cookies use, please read our cookies statement on our Website.

Generally

The table below outlines how we use your personal information and our reasons. Where these reasons include legitimate interests, we explain what these legitimate interests are.

What we use information for	Description	Our legal basis
To operate our business, we use: Identity and Contact Data Transaction Data Account Data Voice Data Publicly Available Data Usage Data Technical Data	We use your personal data to ensure we can run our business, by enabling you to create an account, browse our Website, use our services, and so that we can provide and maintain our Website’s functionality. We will also use such personal data to (a) hold events, such as seminars, webinars, open days or corporate hospitality to promote our business and its services, and (b) operate and develop our alumni network and the activities of our alumni programme, if you opt into either. We also use your personal data where it is necessary to verify your identity and to satisfy legal or regulatory requirements to which we are subject. Further, we use your personal data in order to exercise and protect our legal rights. For example, to detect, prevent and respond to: (i) fraudulent activity and claims, such as creation of new accounts by banned users; (ii) intellectual property infringement claims; or (iii) violations of law or our terms.	Legitimate interest to operate our business in an efficient, safe and lawful way and protect it from unlawful activity. In some cases, we are under a legal obligation (whether by a regulatory authority or a court order) to conduct certain checks and disclose personal data.
To provide you with information you may ask for, we use: Identity and Contact Data Account Data Transaction Data	We may use your personal data when we communicate with you, for example, if you contact us with questions about any products, services or our business in general.	Consent Legitimate interests to fulfil enquires you might make of us so that we are able to respond to your queries in an appropriate and personalised way and also assist you with your experience with us.
To allow you to register for updates or for notifications of blog posts on our Website, or to allow you to register for events that we may be hosting, we use: Identity and Contact Data Account Data Marketing Data Consents Data	We use your personal data to better understand your preferences and to personalise the messages we send to you. This includes sending you information by email and/or post about our products and services, as well as news or events that may be of interest to you.	Consent
To allow you to register as a member of our alumni network, we use: Identity and Contact Data Account Data Marketing Data Consents Data	We use your personal data to better understand your preferences to join our alumni network. This includes sending you information by email and/or post about our alumni network.	Consent
To improve, administer and protect our business and this Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data), we use: Identity and Contact Data Account Data Usage Data Technical Data	We analyse data about your use of and feedback on our Website, products and services to provide an improved customer experience. We may use your personal data for product testing and development, as well as site analytics and infrastructure monitoring. We may also use the usage reports, call summaries and field reports when you contact us by phone via our service provider, who provides an efficient AI inbound and outbound call service.	Legitimate interests: To provide efficient client care and services To ensure that our technology operates efficiently and without error To develop new products and services and improve existing ones
To manage our relationship with you, we use: Identity and Contact Data Account Data Transaction Data Consents Data	We may use your personal data when we communicate with you, for example, if we are providing information about changes to our services or our relationship.	Legitimate interests: To provide efficient client care and services For record keeping and firm management Contract performance
To manage the systems that contain our marketing database, and to manage marketing preferences and keep our records up to date, we use: Marketing Data Consents Data Usage Data Technical Data	For data management for marketing and business development purposes.	Legitimate interests: To improve our systems and services, and to manage marketing preferences To seek feedback
Sharing information with third parties, we use: Usage Data Technical Data	To facilitate data-gathering to improve our educational services, our Website, and our marketing efforts.	To improve our marketing strategy and the services that we provide

Where we collect your personal information from

We may collect personal information about you from the following sources:

• Directly from you when you visit our Website or subscribe to our marketing via our mailing list or when you otherwise interact with us online
• From data we generate about you during our relationship with you, such as data collected from cookies and other similar technologies – see our cookie policy which can be accessed from our Website
• Other sources, such as our third party sub-contractors like analytics providers, such as Google Analytics.
• where applicable, from public sources or partners, under the conditions provided for by the regulations. Where data is not collected directly from you, we will provide you with the information required under Article 14 of the GDPR.

Who we share your information with

We share your personal data with our service providers, business partners and other organisations. We may share your personal information with the following third parties:

• Our agents and service providers who we use to help us with marketing.
• Service providers that help us monitor and analyse Website traffic, including Google Analytics.
• Professional service providers, such as messaging services, telephony providers, website hosts and IT software providers who help us run our business.
• Event organisers (if we are organising an external event which you are attending)
• The police, other law enforcement agencies, courts, government authorities or other third parties where we believe it is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of a third party
• Relevant regulators, including the CNIL, in the event of a personal data breach
• Other companies within our group of companies. We may share your personal data with such companies for the purposes of security, optimisation of our products and services, as well as internal reporting.
• Potential or actual purchasers of any part of our business or assets, or advisors and other third parties in the context of a possible transfer or restructuring of our business.

Further details about the specific third parties we engage can be provided on request.

We also share information (including your name, email address, telephone number) with:

• GUS France, an entity in our group, in relation to services provided by it to Y SCHOOLS. GUS France, a simplified joint-stock company with its registered office at 217 Avenue Pierre Brossolette, Troyes (10000), registered with the Troyes Trade and Companies Register under SIREN number 106 635 741; and
• GLS Global Services GmbH, an entity in our group, in relation to services provided by it to Y SCHOOLS including the automated AI services for phone calls detailed above. GLS Global Services GmbH is a company registered in Switzerland registered with Tax ID number CHE-471.674.898 and registered address at Baarerstrasse 38, 6300 Zug, Switzerland.

How we protect your personal information

• We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, service providers, business partners, agents and other third parties who have a legitimate need to know. They will only process your personal information on our instructions or as otherwise agreed and they are subject to a duty of confidentiality.
• We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulators of a suspected breach where we are legally required to do so.
• In some circumstances, we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.
• In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you in accordance with applicable requirements

How long we keep your personal information

We take steps to ensure that the personal data that you provide is retained for only as long as it is necessary for the purpose for which it was collected, including meeting any legal, accounting or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Where we have collected the personal data based on your consent (e.g for marketing purposes) and we have no other lawful basis to continue with that , if you subsequently withdraw your consent then we will delete your personal data. We may also keep a record of correspondence with you (for example if you have made a complaint) for as long as is necessary to protect us from a legal claim.

Where you withdraw your consent to receiving marketing materials or otherwise ask us to stop marketing we will add your details to a suppression list which ensures that we remember not to contact you again.

For further information as to how to withdraw your consent or to ask us to stop other marketing activities see below.

If you withdraw your consent to receiving marketing materials or ask us to stop our marketing activities, we will still communicate with you for other purposes in the normal course of any other relationship we may have with you.

The main applicable retention periods are as follows:

Category / purpose	Retention period
Information requests and unsuccessful applications	3 years from the last contact from the data subject, unless there is an objection or prior deletion request compatible with our obligations
Prospecting and marketing communication data	3 years from the last contact from the data subject; evidence of consent and objections are retained for the period necessary to demonstrate compliance
Enrolled student files	For the duration of the relationship with the student, then archiving for the periods necessary to comply with legal obligations, to prove rights and to manage disputes (legal limitation period of 5 years applicable in civil and commercial matters, etc.).
Billing and accounting records	10 years from the end of the relevant financial year, unless specific legal provisions apply
Call recordings	Up to 6 months maximum for recordings and up to 1 year maximum for analysis documents, in accordance with CNIL recommendations; actual retention period will be limited to what is necessary for the specific purpose (e.g. training cycle, quality review) and documented in our Record of Processing Activities
Cookies and trackers	In accordance with our Cookie Policy; the lifespan of cookies is limited to a maximum of 13 months and is not automatically extended upon new visits; consent to cookies is renewed every 6 months in accordance with CNIL recommendations;
Marketing suppression list	For the period necessary to ensure compliance with your objection

Upon expiry of these periods, data is deleted or securely archived where its retention is required for evidentiary, accounting, tax or defense of our rights purposes.

International transfers

As a global company, we hold some personal information concerning our suppliers and their affairs within the European Economic Area and the United Kingdom. We do work with agents and service providers who may process your personal information on our behalf outside the EEA and UK. If your information is processed outside the EEA and UK, we will ensure that it is protected to the same standards as if it were being processed within the EEA and UK by putting in place a contract with our agents and service providers that provides adequate safeguards, such as Standard Contractual Clauses or equivalent measures.

Switzerland, where GLS Global Services GmbH is located, benefits from an adequacy decision by the European Commission. Where a transfer is made to a country that does not benefit from such a decision, we put in place the required safeguards, including the Standard Contractual Clauses adopted by the European Commission and, where necessary, supplementary measures. You may obtain information on these safeguards by contacting the DPO.

If you require more information or have any queries, please contact our DPO.

Your rights

You have certain rights in relation to your personal data. These include: the right to object to the processing of your data for certain purposes, the right to access your personal data, and the ability to erase, restrict or receive a machine-readable copy of your personal data.

Where you have provided your consent to any use of your personal data, you can withdraw this consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. We will handle any request to exercise your rights in accordance with applicable law and any relevant legal exemptions. If you wish to exercise any of these rights please contact us using the contact details above.

Under the GDPR and the French Data Protection Act (“Loi Informatique et Libertés”), you have the following rights, subject to the conditions provided for by the regulations:

• right of access to your data
• right to rectification of inaccurate or incomplete data
• right to erasure of your data
• right to restriction of processing
• right to data portability for data you have provided to us, where processing is based on consent or contract and carried out by automated means
• right to object, at any time, to processing of your data for direct marketing purposes
• right to withdraw your consent at any time where processing is based on consent
• right to define guidelines relating to the fate of your data after your death, in accordance with French law

To exercise your rights, contact our DPO at the coordinates indicated above. We may request proof of identity where necessary to verify your identity, without such request being disproportionate. We will respond within one month of receipt of your request; this period may be extended by two months in the event of complex requests or a large number of requests, and you will be informed of this within the initial one-month period.

You have the right to make a complaint at any time to the Commission nationale de l’informatique et des libertés (CNIL), the French supervisory authority for data protection issues(whose contact details can be found on its website at https://www.cnil.fr/fr/agir/saisir-la-cnil)). Alternatively, the UK supervisory authority for data protection issues is the Information Commissioner’s Office (ICO)(www.ico.org.uk), and a list of the EU DPA’s can be found here. We consider that CNIL would be the lead supervisory authority for Y SCHOOLS, since France is the place of the majority of our operations. For data protection issues in other countries, you have the right to complain at any time to the supervisory authority for that country.

We would always prefer that you come to us to help address any concerns of a privacy nature however before you go to the CNIL or other applicable supervisory authority, so please contact us in the first instance.

Automated decision-making

We do not take decisions based solely on automated processing producing legal effects concerning you or significantly affecting you in a similar way. Should such a decision be implemented, we will provide you with the information required by the regulations as well as appropriate safeguards, including the possibility of obtaining human intervention.

Mandatory nature of data

Fields marked with an asterisk (*) are mandatory. They are necessary to respond to your request, process your application, manage your enrolment or provide the requested service. If you do not provide this data, we may not be able to process your request or provide you with the relevant service. Other fields are optional.

Glossary – Lawful basis

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting our DPO.

Contractual necessity means processing your data where it is necessary for the performance of a contract to which you are a party or to take preliminary pre-contractual steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

This policy was last updated on 7 September 2026.