Privacy Policy

Preamble

GrandPalaisRmn builds strong and lasting relationships with its visitors and clients, based on mutual trust. Guaranteeing the security and confidentiality of your personal data is therefore a strong commitment.

We apply a policy for the management of your personal data that complies with the Data Protection Act of 6 January 1978 as amended and the General Data Protection Regulation (EU) of 27 April 2016 (or RGPD). Our policy is based on the following principles:

1. you remain in control of your data

2. your data is treated in a clear, confidential and protected manner

3. we are committed to a continuous process of protecting your data

4. the service providers involved in the processing of your data all meet our high standards in the management of personal data

This protection policy sets out our commitments regarding your personal data that we may collect as part of our promotion and sale of derivative products within our bookshops or on our Librairie Boutique Louvre website (hereinafter referred to as "the Site").

It is intended to inform you about:

• the data we collect

• the reasons why we need it;

• the way we handle your personal data;

• the rights you have in this regard and how to exercise them.

It may be modified at any time to take into account any regulatory, editorial or technical changes. We invite you to consult it regularly in order to be aware of the most recent version.

Who is responsible for processing your data?

Établissement public du GrandPalaisRmn

Registered office: 254/256 rue de Bercy - 75570 Paris cedex 12 - France

RCS Paris B 692 041 585

What personal data do we collect?

Personal data is information relating to an directly or indirectly identifiable natural person.

We collect your personal data in three ways:

You may be required to provide us with personal data in particular in the following cases:

-you create a customer account;

-you make purchases on our Website;

-you are browsing our Website;

-you use our applications;

-you subscribe to our newsletter;

-you wish to be informed of the availability of an item;

-you contact us for a request or complaint;

-you participate in a competition;

-you are participating in a study / survey.

We also collect information about you in the course of our relationship with you (transactions, purchase history, or statistics) or automatically when you connect to our Website.

Finally, we may collect your data from social networks:

-when you connect to one of your customer accounts and/or personal space with your Facebook/Twitter/Instagram/Pinterest accounts. We encourage you to manage your privacy settings on these social networks before logging into your customer account / personal area.

-when you join our Instagram page from some of our Websites to follow our news. The data that we may collect in this context are anonymous and processed for purely statistical purposes (in particular to determine the number of subscribers who follow these pages).

We are not responsible for the processing of your personal data by social networking websites that have their own data protection policies. We invite you to consult their policy in order to know your rights with regard to each of them, and to manage your privacy settings.

In this context, we may collect the following personal data:

-your identity: surname, first name, title, date of birth, photocopy of identity card if necessary;

-your contact details: postal address, e-mail address, telephone number;

-your identifiers and subscriber numbers;

-your order and payment information;

-your browsing and connection information on our Website that is necessary for its proper technical functioning or allows us to measure its audience, or to offer you targeted advertising: cookies, tags, tags, tags, domain name, type of Internet browser, etc. For more information, see the section on cookie management;

- any other information you provide to us directly and voluntarily: comments and opinions, preferences, etc.

We ensure that the collection of this data is relevant, adequate, not excessive and strictly necessary for our activities.

Some information is required to benefit from the service concerned (indicated by an asterisk). If you do not provide us with them, we will not be able to provide you with this service.

And if you provide us with the personal data of a third party: you must ensure that the person concerned agrees that his or her personal data may be communicated to us.

Do we collect personal data from minors?

Our products and services are intended only for adults who are able to subscribe to contractual obligations.

Why do we collect your personal data?

The collection and processing of your personal data is only possible for a specific purpose of which you are aware at the time of collection and from which you derive an identified and tangible benefit.

We undertake that your data will be collected for the following purposes:

Process your orders

(purchases, transactions and information messages related to the order)

The legal basis in this context is the execution of the contract. The collection and use of your data for this purpose does not require the collection of your consent

And / or

Manage your customer account as part of our business

On our website Librairie-Boutique Louvre, the customer account is not mandatory. On the other hand, it is very useful because it is a space that is entirely dedicated to you, and which allows you to access your order data and shopping baskets in a transparent way, and to place orders in a simplified way (automatic entry of your data: identification, loyalty card).

The legal basis in this context is the execution of the contract. The collection and use of your data for this purpose does not require the collection of your consent.

And/or

Respond to your requests and complaints

(ex: return of an item, product availability etc.)

In this context, the legal basis for the processing operations is either the performance of the contract if the request is linked to a contractual relationship, or the legitimate interest of GrandPalaisRmn, more specifically our economic interest in communicating clearly with you and in understanding your needs and expectations. The collection and use of your data for this purpose does not require the collection of your consent.

And/or

Communicate on our products and offers

- as part of our museum shop newsletter, which presents news and product innovations related to exhibitions, promotional offers and our in-store events.

This communication is only sent to you if you have clearly given your consent.

We measure the opening rate of some of our newsletters and limit our mailings according to your general profile (age and place of residence) in order to best adapt them to your needs.

-following a shopping cart abandonment or via banner ads targeted to other websites when you have not set your cookies (For more information, see the section on cookie management)

And/or

Improve the use of our Website

In this context, the legal basis for the processing operations is the legitimate interest of GrandPalaisRmn, more specifically its economic interest in constantly improving its Website and its services and in understanding your needs in order to meet your expectations.

And/or

Perform statistics or surveys

These are based on anonymous data that allows us to improve our knowledge of our activities. In this context, the legal basis for the processing operations is the legitimate interest of GrandPalaisRmn, more specifically its economic interest in constantly improving its customer knowledge and expectations.

And/or

Manage your participation in a competition

The legal basis in this context is the execution of the contract. The collection and use of your data for this purpose does not require the collection of your consent.

And/or

To meet our legal obligations and/or to assert our rights

(in the event of control by the competent authorities, management of unpaid debts and/or litigation).

The legal bases in this context are, as the case may be, either compliance with a legal obligation or the legitimate interest. The collection and use of your data for these purposes does not require the collection of your consent.

Who has access to your personal data?

Your personal data are intended solely for GrandPalaisRmn and are only accessible by our employees authorised to manage them, according to the purposes of collection (commercial, administrative, control and marketing services).

By exception, they can be sent to:

- partners as soon as you have explicitly and clearly given your agreement to be contacted by them (consent to receive their offers via an opt-in partner): cultural institutions (museums, cinemas, theatres, concert halls), events and media (written press, radio, television).

-service providers, in particular for IT services (hosting, storage, analysis, data processing, database management or IT maintenance services). These service providers act on instructions from the Rmn-Grand Palais and the procedures for intervention and access to data are strictly regulated by a contract.

-third parties in the context of compliance with a legal obligation or in order to guarantee our rights (authorities and courts, lawyers, tax auditors, etc.)

Where is your data stored? And how are they protected?

Your personal data is stored on servers located within the European Union, either internally on our secure servers or externally by a duly chosen service provider.

As data controller, we implement the necessary security and confidentiality procedures to prevent any risk of fraudulent access, theft or accidental damage or loss of your data.

When a service provider is involved in the processing of personal data, we attach great importance to the technical and organisational measures it undertakes to take to preserve the security and confidentiality of the data.

We also reserve the right to conduct audits of our service providers.

How long do we keep your data and how do we keep it?

The storage periods of your data are defined by us with regard to legal and contractual constraints. These deadlines are set according to the purposes pursued. After these deadlines, the data are either deleted or stored after having been anonymised, i.e. modified in such a way as to make it permanently impossible to link them to a person.

Customer account data / personal area

The data collected when creating a customer account on our Website is retained for as long as you log in/use your account/space.

Data relating to the commercial relationship

The data are kept for the duration of the commercial relationship (including the exercise of legal guarantees), then archived with restricted access and kept for the additional period necessary to comply with our legal obligations or to defend or assert our rights. At the end of this period, your personal data will be anonymized or deleted.

Data collected as part of our newsletter

This data is kept in a current archive for 3/5 years, depending on the newsletter, from the time of registration or the last positive reaction from you. After this period, we will anonymize them unless you have clearly and expressly requested that you re-register.

Data collected via audience and advertising cookies

These data are kept for a maximum period of 13 months from the date of filing. After this period, they are deleted.

What are your rights? How to exercise them?

What are your rights?

Right of information

You have the right to be informed about the purposes for which we collect your data, how we process them, the rights you have and how to exercise them.

Right of access

You have the right to ask us if we have any data about you and to request a copy in an understandable format. This right thus allows you to control the accuracy of the data and, if necessary, to have them rectified or deleted.

Right of rectification

You can correct, update or complete your data directly online on your account/space. You may also ask us to update or supplement the personal data we hold.

Right to withdraw consent

You may unsubscribe from our newsletter at any time by clicking on the link provided for this purpose in the last communication received, or by contacting the department indicated in the same communication.

You also have the right to withdraw your consent to the placement of analytical and advertising cookies at any time. To do this, simply set up your computer's internet browser, tablet or mobile phone. (For more information, see the section on cookie management).

Right of opposition

When we collect your data for the purpose of performing the contract or on the basis of legitimate interest, you have the right, for legitimate reasons, to object to the dissemination, transmission or storage of your data. The right of opposition allows you to object to the use of your data for a specific purpose, provided that you give reasons based on your particular situation.

Right to limitation of processing

If you dispute the accuracy of the data collected or if you object to the processing of your data, you may ask us, when you request rectification or opposition, to freeze the use of your data until your request is examined.

Right to erase your data (right to forget)

You have the right to have your personal data deleted at any time in the following cases:

-the data are not or no longer necessary for the purposes for which we initially collected or processed them;

-you have withdrawn your consent to the use of your data;

-your data must be deleted to comply with a legal obligation.

We may refuse to delete your data when it is necessary:

-the respect of our legal obligations;

-the recognition, exercise or defence of legal claims;

-for scientific or historical research or statistical purposes for use in the public interest.

Right to portability

You have the right to obtain a copy of the data that you have provided us with under a contract or that we have collected with your consent in a structured, commonly used and readable format. This format may be sent to you or to another party at your request.

Right to communicate post-mortem instructions

You may at any time issue instructions regarding the storage, erasure and communication of your personal data after your death.

How to exercise your rights?

We recommend that you contact the department indicated in the last communication you received directly.

In order to allow us to fully understand your request and respond quickly, please specify in your request:

- the right you wish to exercise and, if applicable, the reasons for your request (e.g. deletion of the customer account/personal space, updating of your data)

- your full name and e-mail address as well as your postal address (if you would like a return by post)

The rights you have are individual rights and can therefore only be exercised by the data holder. To meet this obligation, we ask you, when you request it, to provide proof of your identity, either by a customer number or via an authentication space where possible, or by a copy of a valid identity document. The copy of your identity document will of course be deleted by our services as soon as the identity verification has been completed.

We will endeavour to respond to your request within a reasonable time and in any event in accordance with the law.

Right of complaint

If you consider that your rights are not respected or that the protection of your personal data is not ensured in accordance with the applicable regulations, you may file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL).