Privacy policy
Date of last update: 23 July 2024
In this personal data protection policy, Pinault Collection explains how your personal data is collected, managed and processed by Pinault Collection when you visit the www.pinaultcollection.com website and the Bourse du Commerce.
Other websites linked to the Pinault Collection, in particular the bookshop website (bookshop.pinaultcollection.com), the Halle aux grains restaurant website (https://www.halleauxgrains.bras.en) or the Palazzo Grassi - Punta Della Dogana website are managed by other independent data controllers, within the meaning of the RGPD, with their own data protection policies, which you should consult directly on the pages of the concerned websites.
1. Who is the data controller?
Your personal data is processed by Pinault Collection, 12, rue François 1er, Paris 8e, SASU with capital of €1,630,060,740, registered with the Paris Trade and Companies Registry under number RCS Paris 807 902 036 ("Pinault Collection"). Pinault Collection acts as data controller for the processing operations described in this policy.
2. What categories of personal data are processed by Pinault Collection?
Pinault Collection collects and processes the following categories of personal data:
- data relating to your identity (e.g. surname, first name, email address);
- data relating to tickets and membership cards (e.g. purchases, admissions, attendance);
- data relating to your professional situation (e.g. job title, professional contacts, resume);
- connection data (e.g. IP address, connection logs);
- data relating to the settlement and payment of transactions.
Only personal data that is strictly necessary for the purposes described below is collected.
3. When is your personal data collected?
Personal data is obtained directly from you or as a result of your use of the website or your visit to the Bourse du Commerce.
If your personal data is collected by means of a form, you will be informed of the compulsory nature of the information to be provided by an asterisk (*) or any other indication near the fields concerned. If you do not reply, we will not be able to process your request.
4. For what purposes is you personal data processed, on what legal grounds and for how long is it kept?
Pinault Collection processes your personal data for the purposes described in the table below. The lawful basis for such processing and the associated retention periods are also set out in this table.
5. Who are the recipients of your personal data?
Your personal data may be communicated to the following recipients, depending on their responsibilities and the purposes for which they are to be used:
- Pinault Collection staff working in the marketing, publicity, administration, IT and legal departments;
- staff responsible for control (audit, compliance, DPO) within Pinault Collection;
- Palazzo Grassi and Punta della Dogana (to control access to the museums for holders of membership cards);
- subcontractors involved in the processing of personal data (e.g. reception service provider, online payment service provider, guided tour service provider, ticketing software publisher, digital marketing agency);
- employees of companies involved in financial or legal transactions concerning Pinault Collection.
6. Is your personal data transferred outside the European Union?
To provide its ticketing software, Pinault Collection uses subcontractors located in Switzerland and Vietnam.
For these subcontractors, and in accordance with the applicable data protection provisions, data flows to these countries are governed by agreements drawn up on the basis of the model contractual clauses proposed in Switzerland by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and by the European Commission, in compliance with the provisions of Article 46 of the RGPD.
7. Quels sont vos droits concernant vos données personnelles et comment les exercer ?
Under data protection law you have the following rights regarding your personal data: right of access, rights to rectification, right to object to processing, right to erasure, right to withdrawal of consent, right to restriction of processing, right to portability and right to define directives relating to the retention, deletion and communication of your personal data after your death.
These rights may be exercised by contacting our Data Protection Officer (or DPO) by email: dpo@pinaultcollection.com, or by post: Pinault - Collection - DPO - 48 rue Montmartre, 75002 Paris. Proof of identity may be requested.
You can also send a complaint to the CNIL at the following address: 3 place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07 or via its website https://www.cnil.fr/fr/plaintes.