Privacy policy

Data controller

Personal data collected on the website studentmoov.com (the “Site”) is processed by NOCNOC SAS, a simplified joint-stock company registered with the Lyon Trade and Companies Register under number 817 520 513, whose registered office is at 4 rue du Commandant Dubois, 69003 Lyon, France (“NOCNOC”), acting as data controller. For any question relating to personal data: contact@studentmoov.com or by post to the registered office address.

Data collected

NOCNOC collects only the data the person enters on the Site, and the technical data strictly related to its operation:

• file and account data: first name, last name, date of birth, city and country of birth, city of study, planned arrival date and length of stay, email address;
• order data: amount, date, payment status and technical transaction identifiers. Bank card details are collected directly by the payment provider Stripe and never pass through NOCNOC’s servers;
• technical data: connection logs and data necessary for the security of the Site.

No identity document and no upload is requested. The file data is necessary for drawing up the certificate: without it, the service cannot be provided.

Purposes and legal bases

Account and certificate

Creation and management of the account, drawing up of the certificate, making it available for download, public verification page — performance of the contract.

Payment

Collection of payment, receipt, accounting, prevention of payment fraud — performance of the contract and legal obligations.

Support

Handling of requests, complaints, corrections and refunds — performance of the contract.

Security

Logging, prevention of abuse and securing of the Site — NOCNOC’s legitimate interest.

Audience measurement and advertising

Usage statistics and measurement of advertising conversions — consent, collected via the cookie management module (see the Cookies section).

Emails sent by the Site are limited to the performance of the service (sign-in link, payment receipt). NOCNOC does not use these addresses for commercial prospecting.

Public certificate verification page

Each certificate bears a QR code and a verification link allowing its authenticity to be checked on a public page of the Site. That page displays the information appearing on the certificate: the holder’s last name, first name, date and city of birth, the document reference, and the address and rent of the housing unit stated on it. It is accessible to anyone holding the link or the QR code — in practice, the persons to whom the holder hands their certificate, in particular consular authorities. This page is not indexed by search engines and ceases to be accessible upon expiry of the certificate’s retention period.

Retention periods

• certificates and file data: three years from the issue of the certificate, after which the documents are deleted and the identity data anonymised;
• account: duration of use of the service, within the limit of the above period;
• contract and accounting records: ten years, under statutory archiving obligations (Articles L. 213-1 of the French Consumer Code and L. 123-22 of the French Commercial Code);
• technical logs: twelve months at most.

Recipients and processors

The data is accessible to NOCNOC’s authorised staff and to its technical processors, only to the extent necessary for their tasks:

• Vercel Inc. (United States) — hosting of the Site;
• Supabase — database, authentication and secure storage of the certificates;
• Stripe — payment processing;
• Hostinger (European Union) — sending of the Site’s emails;
• Meta and PostHog (via Google Tag Manager) — only if the person has consented, for the measurement of advertising conversions and audience measurement (see the Cookies section).

The data is neither sold nor transferred to third parties for commercial purposes. It may be disclosed to the authorities where the law so requires.

Transfers outside the European Union

Some processors are established in the United States or may process data there. These transfers are governed, depending on the provider, by the European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, for providers certified under it, or by the European Commission’s standard contractual clauses, supplemented where appropriate by additional measures. A copy of the applicable safeguards can be requested from contact@studentmoov.com.

Cookies and other trackers

The Site uses two categories of trackers:

• strictly necessary trackers, exempt from consent: the session cookie (account sign-in) and the language preference cookie. They cannot be disabled; the Site would not work without them;
• trackers subject to consent: the Meta pixel (measurement of advertising conversions) and PostHog, loaded via Google Tag Manager (audience measurement). They are only set or triggered after consent, given via the Site’s cookie management module.

The person may give, refuse or withdraw their consent at any time from the cookie management module, without any consequence on the use of the service. Refusing the trackers subject to consent prevents neither ordering nor downloading the certificate.

Rights

In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act, every person has the rights of access, rectification, erasure, restriction of processing, objection and portability of their data, the right to withdraw their consent at any time for processing based on it, and the right to decide what happens to their data after their death.

These rights are exercised with NOCNOC: contact@studentmoov.com or by post at 4 rue du Commandant Dubois, 69003 Lyon, France. Proof of identity may be requested in case of reasonable doubt as to the identity of the requester. NOCNOC has not appointed a data protection officer; the contact point above serves that purpose.

Any person who considers that their rights are not being respected may also refer the matter to the French supervisory authority, the CNIL (Commission nationale de l’informatique et des libertés): www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Security

The data is protected by appropriate technical and organisational measures: encryption of exchanges, storage of the certificates in a private space accessible only through short-lived signed links, restricted and controlled access to the data, and no retention of card details by NOCNOC.

Automated decisions and updates

NOCNOC takes no fully automated decision producing legal effects on individuals. This policy may be updated; the applicable version is the one published on this page, with its update date. The terms of sale of the service are set out in the Terms of service.