Privacy policy

GROUPE PÉRIPLEA supports students, recent graduates and professionals in their international mobility. We act as the local representative of approved sponsor organisations, for three distinct programmes:

• J-1 Visa (Intern, Trainee, Specialist) — United States, site visa-j1.fr, in partnership with InterExchange, Intrax and Cultural Vistas.
• UK Visa — GAE (Government Authorised Exchange) — United Kingdom, site visa-uk.fr, in partnership with BUNAC/JENZA.
• Work & Travel USA — United States, site workntravel.fr, in partnership with InterExchange.

This policy applies to these three sites and to all data processing carried out as part of our services.

Data controller: GROUPE PERIPLEA, a simplified joint-stock company (SAS) with share capital of €1,667.00, registered with the Aix-en-Provence trade register under number 895 131 456, SIRET 895 131 456 00017, APE code 85.69Y (educational support activities not elsewhere classified), intra-EU VAT number FR14 895 131 456, with its registered office at 152 chemin de la Petite Bastide, 13770 Venelles, France.

Contact: contact@visa-j1.fr, contact@visa-uk.fr or contact@workntravel.fr, depending on the programme concerned.

Data protection contact: by email at yves@periplea.com, or by post to the registered office, for the attention of the Legal Department.

We collect only the data needed to verify your eligibility, assemble your file and follow your programme. What we hold varies with the stage you have reached.

2.1 Data you give us

• Identification — surname, first name, date and place of birth, nationality, sex as shown on your passport. Collected at the eligibility check, then when your file is assembled.
• Contact details — postal address, email, telephone number. Collected at the eligibility check.
• Academic and professional background — institution, level and year of study, qualifications, CV, work experience, level of English. Collected at the eligibility check and for your file.
• Administrative documents — passport, certificate of enrolment, transcripts, attestations, proof of residence permit where applicable. Collected when your file is assembled.
• Mobility project — host company or organisation, role, dates, location, placement preferences. Collected for your file and placement.
• Emergency contact — name and contact details of a next of kin. Collected before departure.
• Payment — amount, date, transaction reference. Collected when the deposit and the balance are paid.

We do not collect sensitive data within the meaning of Article 9 of the GDPR (health, opinions, sexual orientation and so on). If a document you send us incidentally contains any, we invite you to redact it before sending.

2.2 Data generated by our exchanges

• Recordings of telephone calls and notes taken during qualification and follow-up interviews. You are told orally at the start of the call, and you may ask for a call not to be recorded.
• Email correspondence archived as part of following your file.
• The history of your file in our customer relationship management tool: stages completed, exchanges, documents received.
• Proof of consent: boxes ticked, date, time, IP address, and the exact wording displayed when consent was obtained.

2.3 Browsing data. Our sites place cookies and trackers. Details are in section 8.

2.4 Automated decision-making. The online eligibility check is a tool to help qualify your enquiry; it produces no automated decision with legal effect or similarly significant effect within the meaning of Article 22 of the GDPR. Every decision on your file is checked by a member of our team.

Each processing operation rests on a specific legal basis, in accordance with Article 6 of the GDPR.

• Verifying your eligibility for the programme — pre-contractual steps taken at your request (Art. 6.1.b). Kept for 24 months from the last contact if the file does not proceed.
• Assembling and following your visa file — performance of the contract (Art. 6.1.b). Kept for 24 months after the end of the contractual relationship.
• Passing your file to the sponsor — performance of the contract (Art. 6.1.b). Kept for the period set by the sponsor, under its own policy.
• Calling you about your enquiry — consent (Art. 6.1.a), obtained in accordance with Article L. 223-1 of the French Consumer Code. Proof kept for 3 years; the consent itself is valid for 12 months.
• Recording calls as evidence — legitimate interest: evidence of exchanges and quality of service (Art. 6.1.f). Kept for 24 months after the end of the contractual relationship.
• Keeping proof of your waiver of the right of withdrawal — legal obligation and legitimate interest, legal defence (Art. 6.1.c and 6.1.f). Kept for 5 years from payment.
• Sending you commercial information — consent (Art. 6.1.a). Kept for 3 years from your last contact.
• Publishing your success on our professional networks — consent (Art. 6.1.a). Kept until you withdraw your consent.
• Drawing up and keeping accounting records — legal obligation (Art. 6.1.c GDPR; Art. L. 123-22 of the French Commercial Code). Kept for 10 years.
• Handling a complaint or dispute — legitimate interest: defence of our rights (Art. 6.1.f). Kept for the duration of the proceedings, then the applicable limitation period.

When these periods expire, your data is deleted or irreversibly anonymised. Some data may be archived separately, with restricted access, where keeping it is necessary to defend our rights.

4.1 Within our organisation. Only those GROUPE PÉRIPLEA staff whose duties require it have access to your file: the qualification team, the advisers responsible for following your case, the accounts department and the legal department in the event of a complaint. Every access is under a named account.

4.2 The sponsor organisations. Passing your file to the sponsor is essential to obtaining your visa. It is limited to the information strictly necessary.

• J-1 Intern / Trainee — InterExchange, 100 Wall St #301, New York, NY 10005, United States.
• J-1 Intern / Trainee — Intrax, Giesebrechtstr. 10, 10629 Berlin, Germany.
• J-1 Specialist — Cultural Vistas, 1250 H Street NW Suite 300, Washington DC 20005, United States.
• UK Visa (GAE) — BUNAC/JENZA, 5 Richbell Place, London WC1N 3LA, United Kingdom.
• Work & Travel USA — InterExchange, 100 Wall St #301, New York, NY 10005, United States.

Each sponsor acts as an independent data controller for the processing it carries out. We invite you to consult its own privacy policy.

4.3 Our service providers. We use processors acting on our instructions and bound by contract in accordance with Article 28 of the GDPR: hosting of our websites and data; customer relationship management (CRM) tool; online payment provider; business email and telephony solutions; our accountant and, where applicable, legal counsel. A named list of our processors, and their locations, is available on request from our data protection contact.

4.4 Other recipients. The host company or organisation, for the information needed for your placement; the international mobility officer at your institution, to verify your certificate of enrolment, with your agreement; administrative or judicial authorities, on lawful request.

We never sell your data and never pass it to any third party for advertising purposes.

Our programmes inherently involve transfers of data to third countries.

5.1 United Kingdom. Data passed to BUNAC/JENZA is covered by the adequacy decision adopted by the European Commission in respect of the United Kingdom. This transfer offers a level of protection recognised as equivalent to that of the European Union.

5.2 United States. Data passed to InterExchange and Cultural Vistas is governed by one of the following mechanisms provided for in Chapter V of the GDPR, depending on the recipient’s certification status:

• Where the recipient is certified under the EU-US Data Privacy Framework (DPF): the transfer rests on the adequacy decision adopted by the European Commission on 10 July 2023 (Art. 45 GDPR). The recipient’s certification can be checked at dataprivacyframework.gov.
• Where there is no DPF certification: the transfer rests on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), supplemented where appropriate by additional measures.

A copy of the applicable safeguards can be provided on request from our data protection contact. We follow developments in the legal framework applicable to transfers to the United States, currently the subject of litigation before the courts of the European Union, and will adapt the basis relied on if necessary.

These transfers are necessary for the performance of the contract you enter into with us and for completing visa formalities with the American authorities.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Access — obtain confirmation that we process your data and receive a copy of it, including recordings of calls concerning you.
• Rectification — have inaccurate or incomplete information in your file corrected.
• Erasure — ask for your data to be deleted, subject to our legal retention obligations.
• Restriction — ask for processing to be temporarily frozen while a check is carried out.
• Portability — receive the data you have given us in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interest, on grounds relating to your situation.
• Withdrawal of consent — withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
• Post-mortem directives — set directives on what happens to your data after your death.

How to exercise your rights. Send your request to our data protection contact, by email at yves@periplea.com or by post to GROUPE PERIPLEA, Service Juridique, 152 chemin de la Petite Bastide, 13770 Venelles, France. We may ask you for proof of identity where there is reasonable doubt as to who you are.

We reply within one month of receiving your request. That period may be extended by two months where the request is complex; we then tell you within the first month.

Call recordings. You may obtain a copy. Where a recording contains personal data about third parties, we may redact it before disclosure, in accordance with Article 15.4 of the GDPR.

Complaints. If you consider that your rights are not being respected, you may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — or online at www.cnil.fr.

Since 11 August 2026, telephone marketing to individuals requires your prior consent, under Article L. 223-1 of the French Consumer Code.

When you complete our eligibility check, we ask whether you agree to be called about your enquiry. This consent:

• covers only the programme you contacted us about and our associated support services;
• is valid for twelve (12) months from the date it is given, after which we will ask you again;
• may be withdrawn at any time, without formality, including orally during a call;
• is never a condition of using our services: you may refuse to be called and deal with us by email only.

We keep proof of this consent (date, time, exact wording displayed, any time slots given) for three (3) years. You may obtain a copy on request.

On your first visit to one of our sites, a banner lets you accept, refuse or configure cookies. Refusing is as simple as accepting.

• Strictly necessary — operation of the site, security, basket and payment session. No consent required. Duration: session to 13 months.
• Audience measurement — visitor statistics and improvement of the site. Consent required, except for exempt configurations. Duration: 13 months maximum.
• Advertising and social networks — measurement of our campaigns and content sharing. Consent required. Duration: 13 months maximum.

A named list of the cookies placed is available from the cookie management banner at the foot of every site. You may change your choices at any time through that same banner. Visitor data is kept for no more than 25 months.

We put in place appropriate technical and organisational measures to protect your data against loss, unauthorised access, alteration or disclosure:

• encryption of exchanges (HTTPS) across all our sites;
• access to files limited to authorised staff, through named accounts;
• hosting with providers offering appropriate security safeguards;
• regular backups and access logging;
• data protection awareness training for our teams.

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible, in accordance with Article 34 of the GDPR.

Our programmes are for adults. We do not knowingly collect data concerning people under 18. If you believe a minor has sent us data, contact us and it will be deleted.

We may update this policy, in particular to take account of legal changes or changes to our services. The applicable version is the one published on our sites on the date of your visit. Where a change is substantial, we will tell you by email or through a banner on our sites.

Last updated: 15/09/2026.

GROUPE PÉRIPLEA
Legal Department — Data protection
152 chemin de la Petite Bastide, 13770 Venelles, France
Email: yves@periplea.com
Programmes: visa-j1.fr · visa-uk.fr · workntravel.fr