Privacy and data protection policy (GDPR)

1. Data controller

Institut der Fuchs (Institut de Formation Professionnelle de Langue Der Fuchs), Bafoussam, Cameroon.
E-mail: contact@institutderfuchs.de · Phone / WhatsApp: +237 657 718 770.
For any question about your data, write to contact@institutderfuchs.de with "Personal data" in the subject line.

2. Applicable law

We apply Cameroonian law on the protection of personal data and, for persons located in the European Union, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

3. Data collected

• Identity: surname, first name, sex, date and place of birth, nationality, photo (optional).
• Contact details: e-mail address, phone number, postal address and, where applicable, those of a parent or emergency contact.
• Identity document or birth certificate: required to complete registration and to issue accurate course certificates.
• Studies: level, group, attendance, assessments, exam results, course certificates issued.
• Payments: amounts, dates, payment method and receipts. We do not store any bank card numbers.
• Correspondence: messages sent to support and through the contact form.
• Security: history of logins and failed login attempts (IP address, device and browser type, date), used to protect accounts. An automatic model, running only on our servers, learns the login habits of each account (network, device type, time) to spot an unusual login; a verification code is then requested by e-mail.
• Virtual classrooms: display name and participation; video and audio are transmitted only if you turn on your camera or microphone.

4. Why we use them (purposes and legal bases)

• Managing your registration, courses, assessments, payments and course certificates: performance of the training contract.
• Keeping our accounts: legal obligation.
• Securing the website and accounts (two-factor authentication, blocking of repeated attempts, anti-bot protection): legitimate interest.
• Measuring audience anonymously (internal statistics without cookies): legitimate interest.
• Measuring audience with Google Analytics and analysing the usability of the site (display time, errors, repeated clicks, abandoned forms, never what you type), and sending you information about our activities: only with your consent, which you may withdraw at any time.
• Wishing you a happy birthday and reminding you of your payment deadlines and classes: performance of the contract and legitimate interest; you may ask to stop receiving them.

5. Who has access to your data

• Authorised staff of the institute: management, the administrative office, and teachers, for the students in their own groups only. Identity documents are accessible only to the administration and to the person concerned.
• Our technical service providers, acting on our instructions: hosting of the website and data, and e-mail (FirstHeberg, servers located in France); anti-bot protection of forms (Google reCAPTCHA); virtual classrooms (LiveKit); Google Analytics audience measurement, only if you accept it.
• Public authorities, only where required by law.

We neither sell nor rent your data. Some providers (Google, LiveKit) may process data outside Cameroon and the European Union; these transfers are governed by their contractual data protection commitments.

6. Retention periods

• Training file (identity, studies, course certificates): for the duration of the training, then 5 years, so that a duplicate course certificate can be issued.
• Accounting documents and entries (payments, receipts): 10 years.
• Identity document: until the end of the training and the issuance of the course certificate, then 1 year at most.
• Messages to support and through the contact form: 3 years after the last exchange.
• History of failed login attempts: 12 months.
• History of successful logins: the last 200 of each account.
• Usability signals: anonymous totals per page, 6 months.
• Visit statistics: anonymous totals only, without time limit.
• Cookies and consent preferences: 13 months at most.

7. Cookies

• Necessary cookies (no consent required): login session, form protection (CSRF), selected language, storage of your cookie choices, reCAPTCHA anti-bot protection on the login, registration and contact forms.
• Google Analytics audience measurement (with consent): anonymised IP address, no advertising. Our internal statistics use no cookies.
• The website uses no advertising cookies.

You can change your choices at any time using the "Manage cookies" link at the bottom of every page. Refusing non-necessary cookies does not prevent you from using the website.

8. Security

Encrypted connection (HTTPS), passwords stored in irreversibly encrypted form, two-factor authentication mandatory for staff and offered to students, limitation of login attempts, sensitive documents not publicly accessible, regular backups. In the event of a data breach that poses a risk to you, we will inform you without undue delay.

9. Minors

A person under 18 may only be registered with the agreement of a parent or legal guardian, who may exercise the rights described below on their behalf.

10. Your rights

You may request access to your data, their rectification or erasure, or the restriction of their processing; object to their use; request their portability; and withdraw any consent given at any time. Some of your information can be changed directly in your student area (Settings).

To exercise these rights, write to contact@institutderfuchs.de from your account's e-mail address. We respond within one month. However, certain data must be retained to comply with our legal obligations (accounting) or to issue your course certificates.

If you believe your rights have not been respected, you may lodge a complaint with the competent data protection authority: in Cameroon, the authority provided for by the law on the protection of personal data; in the European Union, the authority of your country of residence (in France, the CNIL; in Germany, the data protection authority of the relevant Land).

11. Changes

This policy may change, in particular when a new service is introduced or the law changes. The date of the last update is shown at the top of the page.