Charte de protection des données personnelles

This Personal Data Protection Charter describes the commitments made by LUMA/Arles, as the data controller, to ensure the protection of your personal data. Through this Policy, LUMA Arles aims to inform you clearly about how your personal data is collected and used when you use our website www.luma.org (the “Site”) and/or our mobile application LUMA (the “Application”), as well as in the context of your relationships of any nature with LUMA Arles.

Accordingly, LUMA Arles is committed to complying with the European General Data Protection Regulation (GDPR) (No. 2016/679) as well as French Law No. 78-17 on Information Technology, Data Files, and Civil Liberties.

This Charter may be updated. In such cases, we will indicate the date of the latest update at the bottom of this Charter. Your consent will always be required if the update to this privacy statement impacts the way your personal information is used compared to the provisions outlined in this Charter at the time your information was collected.

2. PRINCIPLES APPLIED TO PROTECT YOUR DATA

In compliance with applicable regulations, LUMA Arles abides by the following principles:

1. Lawfulness

LUMA Arles processes personal data only if one of the following legal grounds is met:

The explicit consent of the data subject has been obtained, or
Processing is necessary for the performance of a contract to which the data subject is a party, or
processing is required to comply with a legal obligation, or
processing is necessary to protect the vital interests of the data subject, or
LUMA Arles pursues a legitimate interest that does not infringe the fundamental rights and freedoms of the data subject.

2. Fairness

Personal data is collected fairly, and its use is clearly explained, specifying its purpose.

3. Purpose and minimization

Data is collected for specific, explicit and legitimate purposes. Only data that is strictly necessary to achieve these purposes is collected. If the same result can be obtained with less data, only the latter is used.

4. Transparency

LUMA Arles informs data subjects of the manner in which their data is collected, processed and stored.

5. Individual rights

LUMA Arles facilitates the exercise of the rights of data subjects, in particular:

The right of access to data,
The right to rectification,
The right to erasure,
The right to object to processing.

6. Retention period

Personal data is kept only for as long as is strictly necessary for the purposes for which it was collected.

7. Security

LUMA Arles ensures the integrity and confidentiality of personal data, implementing appropriate technical and organizational measures to prevent any breach.

8. Sharing with third parties

When data is transmitted to third parties, LUMA Arles ensures that these parties comply with sufficient data protection guarantees.

9. Transfers outside the European Union

In the event of transfer of personal data outside the European Union, LUMA Arles ensures that this transfer is governed by the appropriate legal provisions (standard contractual clauses, adequacy decision, etc.).

10. Data breach

In the event of compromise of personal data (loss, theft, alteration, unavailability...), LUMA Arles notifies the incident to the competent data protection authority and, if necessary, to the persons concerned, particularly when the breach is likely to give rise to a high risk to their rights and freedoms.

3. WHAT DATA IS PROCESSED AND HOW IS IT COLLECTED ?

1. Your personal data

LUMA Arles is careful to collect only the data that is strictly necessary for the purpose of processing.

The term “data” refers to any information that allows you to be identified, directly or indirectly, as a natural person, and that you communicate to us in the course of your interactions with our organization.

When collecting your data via a digital form, the mandatory nature of certain information is indicated by an asterisk (*) or any other equivalent indicator.

Data not marked as mandatory is optional. They enable us to improve our knowledge of our audiences and the quality of our services and communications. You are free not to provide this information.

The collection of data relating to minors under the age of 18 is limited. It may only concern the name, nationality and date of birth of the minor, and only in the context of a proven necessity. This data may only be transmitted by a legal representative. We ask you to ensure that your children do not send us any personal data without your permission (particularly via the Internet). In the event of such transmission, you can contact our Data Protection Officer (see article 12 “What are your rights and how to exercise them?”) to request their deletion.

2. Data collection methods

Data you provide directly to us
We collect personal data that you provide to us voluntarily, including :

your identity data (surname, first name, date of birth, nationality),
your contact details (e-mail address, telephone numbers, home and work addresses),
information related to your activity or socio-professional profile,
payment data necessary for booking or purchasing products and services (including credit/debit card numbers via our payment service providers).

This data may be collected in the following cases:

when you make a purchase or use our services,
when you register on our website,
when you connect to our Wi-Fi network,
when you take part in a survey, newsletter or promotional operation,
when you use our help section or other online functionalities.

Data collected automatically
When you browse our website or connect to our Wi-Fi, certain technical data may be collected automatically, such as :

type of device used,
operating system,
IP address,
browser type,
location data (if activated),
diagnostic, performance and usage information relating to access to our content.

We may also record your interactions with our teams (e-mail exchanges, telephone calls, booking histories, etc.), as part of our ongoing relationship with you.

Data from partners
Subject to adequate safeguards, we may also receive data about you from trusted partners. This data is shared only when these partners have a valid legal basis for doing so (consent, contract, legal obligation or legitimate interest). This information may have been collected by these third parties directly from you, or as part of their own processing.

4. WHAT ARE THE LEGAL BASES FOR PROCESSING YOUR DATA ?

The collection and processing of your personal data is based on one or more of the legal bases set out in Article 6 of the General Data Protection Regulation (GDPR). Depending on the case, your data may be processed on the basis of:

1. Explicit consent

Where required, LUMA Arles seeks your prior consent for the collection and use of certain data, in particular:

to send you marketing communications,
for newsletter registration,
or for the use of non-essential cookies.

You may withdraw your consent at any time, without this compromising the lawfulness of the processing carried out prior to such withdrawal.

2. Contract performance

Certain data is essential for the performance of a contract or pre-contractual measures, in particular :

when managing an order or reservation,
to register for a service,
or for the provision of assistance or customer service.

3. Compliance with a legal obligation

LUMA Arles may be required to process certain data in order to comply with its legal obligations, in particular with regard to :

tax (e.g. keeping proof of payment),
accounting,
or the fight against fraud and money laundering.

4. Legitimate interest

Lastly, certain processing operations are based on LUMA Arles' legitimate interests, provided that they do not infringe the fundamental rights and freedoms of the persons concerned. The purpose of such processing may be to :

to ensure the security of computer systems,
to ensure the security of computer systems,
to ensure the security of computer systems,
to carry out studies or satisfaction surveys.

5. WHEN IS YOUR PERSONAL DATA COLLECTED ?

LUMA Arles may collect your personal data in the following situations, in connection with its cultural, commercial, educational or administrative missions:

1. As part of your visit

Purchase of tickets (on site or via online ticketing)
Booking group visits
Participation in guided tours

2. When selling products or services

Reservation of spaces as part of a privatization program
Purchase of products via the online store

3. As part of educational activities

Registration and participation in workshops, educational or school events

4. For parking lot use

Use of on-site parking
Reserving parking spaces via an online platform

5. For marketing or customer relations purposes

Subscription to a newsletter or promotional communications
Participation in satisfaction surveys
Participation in promotional programs or events

6. As part of application processing

Receipt and management of job, internship and volunteer applications.

7. Video protection

Capture of images via cameras installed on site, for purposes of personal and property security.

6. HOW LONG IS YOUR DATA KEPT?

Your personal data will only be kept for as long as is strictly necessary for the purposes for which it was collected, or in accordance with applicable legal obligations.

1. Retention periods

Retention periods vary according to :

Applicable laws and regulations (Commercial Code, Civil Code, Labor Code, Consumer Code, etc.)
CNIL guidelines
The data controller's operational requirements, in line with the intended purpose and in compliance with the principle of proportionality.

Once this period has elapsed, the data is deleted or anonymized.

2. Intermediate archiving

Certain data may be subject to intermediate archiving at the end of the retention period, in order to :

to meet legal, tax or accounting obligations ;
to meet any legal statute of limitations.

3. Right to erasure

You may request the deletion of your personal data at any time, within the limits imposed by our legal obligations.

7. WHO IS RESPONSIBLE FOR DATA COLLECTION AND PROCESSING ?

The entities mentioned in article 1 are jointly responsible for the processing of personal data.

SAS LUMA Arles is designated as the main contact for exercising the rights of data subjects. It is responsible for setting up and maintaining systems for handling data protection requests..

A Data Protection Officer (DPO) has been appointed.
You can contact him at the following address: dpo@luma-arles.org

LUMA Arles undertakes to respect the commitments described in this policy whenever you use its services or subscribe to its offers.

LUMA Arles cannot be held responsible for the confidentiality practices, content or security level of third-party sites accessible via hypertext links from its own sites.

8. TO WHOM IS YOUR DATA TRANSMITTED ?

1. External recipients - Suppliers, service providers and partner

LUMA Arles may pass on some of your personal data to third parties in the following cases:

Technical subcontractors (site management, hosting or traffic analysis)
Service providers (payment platforms, marketing or statistical solutions)
Authorized contractual partners

2. Secure payment

Bank details required for payment processing are collected and stored exclusively by an authorized payment service provider on behalf of LUMA Arles.
Visual cryptograms (CVV) are never stored.

The identity of subcontractors may be communicated on request.

LUMA Arles ensures that each of its subcontractors offers sufficient guarantees in terms of data security and protection, in accordance with Article 28 of the RGPD.

3. Internal recipients

Your data may be consulted, within the limits of their remit, by the following teams:

Communication Department
IT Department
Legal Department
Accounting Department
Human Resources Department
Development
Public Relations
Partnerships and sponsorship
Security/Safety Team

10. USE OF COOKIES

1. What is a cookie?

Un cookie est un fichier texte déposé sur votre terminal lors de la navigation sur un site ou d’une interaction avec un service en ligne. Il permet de collecter des informations relatives à votre navigation et de vous proposer des services personnalisés.

2. Types of cookies used

Strictly necessary cookies : essential for site operation (e.g. preferences, login).
Analytical cookies : used to measure audience size and improve site operation.
Third-party cookies : used for advertising or personalization purposes by external partners (e.g. advertising agencies, social networks).

3. Consent

On your first visit, a banner informs you of the presence of these cookies and allows you to express your preferences.

You can modify your choices at any time via the “Cookie management” page, accessible at the bottom of the page.

4. List of cookies

You can find the full list of cookies here.

11. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

As a general rule, LUMA Arles stores personal data within the European Union.

Nevertheless, insofar as, for example, some of our service providers are located in countries outside the European Union (“Third Countries”), LUMA Arles may transfer some of the personal data to Third Countries. This may in particular be the case to Third Countries for which the European Commission has not issued an “adequate protection” decision. In such a case, LUMA Arles ensures that this transfer is carried out in compliance with the applicable regulations and guarantees a sufficient level of protection for the privacy and fundamental rights of the persons concerned (in particular through the European Commission's standard contractual clauses).

Data flows to countries that do not offer personal data protection equivalent to that required within the European Union are governed by the standard contractual clauses defined by the European Commission.

12. WHAT ARE YOUR RIGHTS AND HOW TO EXERCISE THEM ?

In accordance with European Regulation 2016/679 of April 27, 2016 on the protection of personal data, Law No. 2018-493 of June 20, 2018 on the protection of personal data and Law nᵒ 78-17 of January 6, 1978 known as the Loi Informatique et Libertés, you have:

A right of access : the right to obtain confirmation from LUMA Arles that your data is or is not being processed, as well as to receive a copy of your personal data in our possession.
the right to rectification : the right to modify erroneous or obsolete personal data in our possession concerning you.
The right to erasure or the right to be forgotten : the right to erase your personal data in our possession (except where the law requires us to keep this data or where we have a legitimate reason to do so).
The right to object : you may object at any time, for reasons relating to your particular situation, to the processing of your personal data for canvassing purposes.

You also have the possibility of objecting to processing based on the legitimate interests of LUMA Arles due to your particular situation, unless there are compelling legitimate grounds for the processing which override the interests and rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims;

A right to limitation: you have the right to limit the processing of your personal data in the following cases:

If you exercise your right to opposition, for the time necessary for us to verify whether LUMA Arles' legitimate motives prevail over yours;

In the event of unlawful processing of your personal data, you may demand that their use be restricted rather than erased;

For personal data that is to be erased for the purposes of processing, but which is still necessary for the establishment, exercise or defense of legal claims.

A right to portability : you have the right to receive the personal data you have provided to LUMA Arles when the latter are processed automatically and have been collected on the basis of your prior consent or the performance of a contract concluded with LUMA Arles. This data must be communicated in a structured, commonly used and machine-readable format. This right also includes the right to transfer this data to another data controller.

Finally, you have the right to define instructions concerning the fate of your personal data after your death.

These rights may be exercised under the conditions and within the limits laid down by the regulations in force. You may also be asked to provide proof of your identity. Any incomplete request cannot be processed by LUMA Arles.

You may contact our Data Protection Officer at any time, free of charge, by filling in the following form: Form

Please note that proof of identity may be required. If you fail to provide proof of identity when required, we will not be able to process your request. In such a case, the response time will be suspended until LUMA Arles has received the additional supporting documents requested.

If no satisfactory solution is found or if the dispute persists, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) or the supervisory authority of the European Union Member State in which you usually reside.

Personal Data Protection Charter

1. SCOPE OF APPLICATION