PERSONAL DATA PROTECTION POLICY
The Gustave Moreau National Museum
Effective November 29, 2019
PREAMBLE
We apply a policy for managing your personal data that complies with the French Data Protection Act of January 6, 1978, as amended, and the General Data Protection Regulation (EU) of April 27, 2016 (or RGPD). Our policy is based on the following principles:
- You remain in control of your data
- Your data is treated in a clear, confidential and protected manner
- We are committed to an ongoing process of protecting your data
- The service providers involved in the processing of your data all meet our high standards in the management of personal data
This privacy policy sets out our commitments regarding your personal data collected on our website www.musee-moreau.fr (hereinafter "the Site")
It is intended to inform you about:
- The data we collect;
- Why we need it;
- How we handle your personal data;
- The rights you have in this respect and how to exercise them.
It may be modified at any time to take account of any regulatory, editorial or technical developments. We invite you to consult it regularly for the most recent version.
WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?
MUSÉE NATIONAL GUSTAVE MOREAU
14, rue de La Rochefoucauld
75009 Paris
WHAT PERSONAL DATA DO WE COLLECT?
Personal data is any information relating to a natural person who can be identified directly or indirectly.
>> We collect your personal data in three ways:
You may be required to provide us with personal data in particular in the following cases:
- You use our applications;
- You subscribe to our newsletters;
- You use our registration form;
- You make a tour reservation;
- You contact us with a request or complaint;
- You take part in events or public relations operations;
- You're taking part in a competition;
- You take part in a study / survey;
We also collect information about you during our relationship with you (statistics), automatically when you connect to the Site.
Finally, we may collect your data from social networks when you join our Facebook, Twitter and Instagram pages from some of our Site in order to follow our news. The data we may collect in this context is anonymous and processed for purely statistical purposes (in particular to find out how many subscribers follow these pages).
We are not responsible for the processing that may be carried out on your personal data by social network websites, which have their own data protection policies. We invite you to consult their policies to find out about your rights in relation to each of them, and to manage your privacy settings.
>> In this context, we may collect the following personal data:
- Your identity: surname, first name, title, age;
- Your contact details: postal address, e-mail address, telephone number;
- Your browsing and connection information on our Site that is necessary for their proper technical operation or enables us to measure the audience: cookies, tags, beacons, domain name, type of Internet browser, etc. To find out more, visit the cookie management section;
- Any other information you provide us directly and voluntarily: comments and opinions, preferences, etc.
We ensure that the collection of this data is relevant, adequate, not excessive and strictly necessary for our activities.
Some information is essential to benefit from the service concerned (indicated by an asterisk). If you do not provide us with this information, we will not be able to offer you this service.
And if you provide us with the personal data of a third party: you must ensure that the person concerned agrees to their personal data being communicated to us.
DO WE COLLECT PERSONAL DATA FROM MINORS?
In principle, our products and services are intended for adults capable of entering into contractual obligations.
By exception, for registration to our newsletter and the use of certain services free of charge, the age of 15 is accepted. In this case, the data holder aged 15, 16 or 17 has a specific right to obtain the deletion of his or her data as soon as possible.
WHY DO WE COLLECT YOUR PERSONAL DATA?
The collection and processing of your personal data is only possible for a specific purpose of which you are aware at the time of collection and from which you derive an identified and tangible benefit.
We undertake that your data will be collected and processed for the following purposes:
- The processing of your requests (reservation, information messages for the preparation of a visit or the cancellation of a visit for example). The legal basis for this is the execution of the contract. The collection and use of your data for these purposes do not require your consent.
- The sending of personalized communications presenting our offers and services, and those of our partners. This may include the newsletter, which presents news about the museum's exhibitions; invitations to special events
These communications are only sent if you have clearly given your consent for each communication. Your consent is collected in a clear and unequivocal manner.
- To meet our legal obligations, to enforce our rights (in the event of control by the competent authorities, management of unpaid bills and/or litigation) and/or to combat fraud (ticket control at the entrance). The legal bases for this are, depending on the case, either compliance with a legal obligation, or legitimate interest (preservation for evidence purposes). The collection and use of your data for these purposes do not require your consent.
- The production of statistics or surveys. These are carried out using anonymized data, enabling us to improve our knowledge of our activities. In this context, the legal basis for processing is the museum's legitimate interest, more specifically its economic interest in constantly improving its knowledge of its customers and their expectations.
- Managing your participation in a competition. The legal basis for this is the performance of the contract. The collection and use of your data for this purpose does not require your consent.
WHO HAS ACCESS TO YOUR PERSONAL DATA?
Your personal data is intended solely for the museum and can only be accessed by our employees authorized to manage it, depending on the purpose of the collection (sales, administrative, control, marketing departments).
Exceptionally, personal data may be passed on to:
- Providers, in particular for IT services (hosting, storage, analysis, data processing, database management or IT maintenance services). These service providers act on instructions from the museum, and the terms of their intervention and access to data are strictly governed by contract.
- Third parties in compliance with a legal obligation or in order to guarantee our rights (authorities and courts, lawyers, tax inspector etc.)
WHERE IS YOUR DATA STORED? AND HOW IS IT PROTECTED?
Your personal data is stored on servers located within the European Union, either internally on our secure servers, or externally by a duly selected service provider.
As data controller, we implement the necessary security and confidentiality procedures to prevent any risk of fraudulent access, theft or accidental damage or loss of your data.
When a service provider is involved in the processing of personal data, we attach the utmost importance to the technical and organizational measures it undertakes to take to preserve the security and confidentiality of the data.
We also reserve the right to audit our service providers.
HOW LONG AND HOW DO WE KEEP YOUR DATA?
The retention periods for your data are defined by us with regard to legal and contractual constraints. These periods are set according to the purposes pursued. After these periods, data is either deleted or kept after being anonymized, i.e. modified in such a way as to make it definitively impossible to link it to a person.
- Customer account/personal area data
Data collected when creating a customer account/personal space on our Site is kept for as long as you log in/use your account/space.
- Data relating to the commercial relationship
Data is kept for the duration of the commercial relationship (including the exercise of legal warranties), then archived with restricted access and kept for the additional period necessary to comply with our legal obligations or for the purposes of defending or enforcing our rights. At the end of this period, your personal data is anonymized or deleted.
- Data collected as part of our newsletters
This data is kept in a current archive for 3 years, starting from the date of subscription or the last positive reaction from you. After this period, we anonymize it unless you have clearly and expressly wished to re-register.
- Data collected via audience and advertising cookies
This data is kept for a maximum of 13 months from the time it is deposited. After this period, they are deleted.
WHAT ARE YOUR RIGHTS? HOW CAN YOU EXERCISE THEM?
What are your rights?
Right to information
You have the right to be informed about why we collect your data, how we process it, what rights you have and how to exercise them.
Right of access
You have the right to ask us whether we hold any data about you and to request a copy of it in an understandable format. This right enables you to check the accuracy of the data and, if necessary, to have it corrected or deleted...
Right of rectification
You can rectify, update or complete your data directly online in your account/space. You can also ask us to update or complete the personal data we hold.
Right to withdraw consent
You can unsubscribe from our newsletters at any time by clicking on the link provided for this purpose in the last communication received, or by contacting the department indicated in the same communication.
You also have the right to withdraw your consent for the placement of analytical and advertising cookies at any time. To do this, simply set the internet browser settings on your computer, tablet or mobile. (To find out more, see cookie management below).
Right to object
When we collect your data for the purposes of contract performance or on the basis of legitimate interest, you have the right, on legitimate grounds, to object to your data being disseminated, transmitted or stored. The right to object allows you to object to us using your data for a specific purpose subject to putting forward reasons relating to your particular situation.
Right to restrict processing
If you dispute the accuracy of the data collected or object to your data being processed, you may ask us, when requesting rectification or objection, to freeze the use of your data while we examine your request.
Right to erase your data (right to be forgotten)
You have the right at any time to obtain the deletion of your personal data in the following cases:
- The data is not or is no longer necessary with regard to the purposes for which we originally collected or processed it;
- You have withdrawn your consent to the use of your data;
- Your data must be deleted to comply with a legal obligation.
We may refuse to delete your data when necessary:
- To comply with our legal obligations;
- To establish, exercise or defend legal claims;
- For scientific or historical research or statistical purposes, or for use in the public interest.
Right to portability
You have the right to obtain, a copy of the data that you have transmitted to us as part of a contract or that we have collected with your consent in a structured, commonly used and readable format. This format may be sent to you or to another party, at your request.
Right to communicate post-mortem directives
You may at any time formulate directives concerning the retention, deletion and communication of your personal data after your death.
How to exercise your rights
You can exercise all your rights:
- By e-mail: info@musee-moreau.fr
- By post: Musée national Gustave Moreau. Service communication. 14, rue de La Rochefoucauld. 75009 Paris. France
To enable us to fully understand your request and respond promptly, please specify in your inquiry:
- The right you wish to exercise and, if applicable, the reasons for your request (e.g. deletion of customer account/personal area, updating of your data)
- Your surname, first name and e-mail address, as well as your postal address (if you wish a return by post)
The rights you enjoy are rights of an individual nature and can therefore only be exercised by the data holder. In order to meet this obligation, we may ask you, at the time of your request, to kindly prove your identity, by a customer number or via an authentication space when possible, or by a copy of a valid identity document. The copy of your ID will of course be deleted by our services as soon as identity verification has been completed.
We will endeavor to respond to your request within a reasonable timeframe and in any event in accordance with the law.
Right to complain
If you feel that your rights are not being respected or that your personal data is not being protected in accordance with applicable regulations, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés.
