PERSONAL DATA PROTECTION POLICY - PINAULT COLLECTION
Date of last update: 23 July 2024
In this personal data protection policy, Pinault Collection explains how your personal data is collected, managed
and processed by Pinault Collection when you visit the www.pinaultcollection.com website and the Bourse duCommerce.
Other websites linked to the Pinault Collection, in particular the bookshop website(bookshop.pinaultcollection.com), the Halle aux grains restaurant website (https://www.halleauxgrains.bras.fr/)
or the Palazzo Grassi - Punta Della Dogana website are managed by other independent data controllers, within
the meaning of the RGPD, with their own data protection policies, which you should consult directly on the pagesof the concerned websites.
Contents
1.
WHO IS THE DATA CONTROLLER? ............................................................................................................................................... 1
2.
WHAT CATEGORIES OF PERSONAL DATA ARE PROCESSED BY PINAULT COLLECTION? ................................................................................ 1
3.
WHEN IS YOUR PERSONAL DATA COLLECTED? ................................................................................................................................ 1
4.
FOR WHAT PURPOSES IS YOUR PERSONAL DATA PROCESSED, ON WHAT LEGAL GROUNDS AND FOR HOW LONG IS IT KEPT? ................................ 15.
WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA? ..................................................................................................................... 3
6.
IS YOUR PERSONAL DATA TRANSFERRED OUTSIDE THE EUROPEAN UNION? ........................................................................................... 3
7.
WHAT ARE YOUR RIGHTS CONCERNING YOUR PERSONAL DATA AND HOW CAN YOU EXERCISE THEM? .......................................................... 3

1.

WHO IS THE DATA CONTROLLER?

Your personal data is processed by Pinault Collection, 12, rue François 1er, Paris 8e, SASU with capital of€1,630,060,740, registered with the Paris Trade and Companies Registry under number RCS Paris 807 902 036("Pinault Collection"). Pinault Collection acts as data controller for the processing operations described in thispolicy.
2.

WHAT CATEGORIES OF PERSONAL DATA ARE PROCESSED BY PINAULT COLLECTION?

Pinault Collection collects and processes the following categories of personal data:-data relating to your identity (e.g. surname, first name, email address);data relating to tickets and membership cards (e.g. purchases, admissions, attendance);
data relating to your professional situation (e.g. job title, professional contacts, resume);connection data (e.g. IP address, connection logs);
data relating to the settlement and payment of transactions.

Only personal data that is strictly necessary for the purposes described below is collected.
3.

WHEN IS YOUR PERSONAL DATA COLLECTED?

Personal data is obtained directly from you or as a result of your use of the website or your visit to the Bourse
du Commerce.
If your personal data is collected by means of a form, you will be informed of the compulsory nature of theinformation to be provided by an asterisk (*) or any other indication near the fields concerned. If you do not
reply, we will not be able to process your request.
4.

FOR WHAT PURPOSES IS YOUR PERSONAL DATA PROCESSED, ON WHAT LEGAL GROUNDS AND FOR HOW LONG IS IT KEPT?

Pinault Collection processes your personal data for the purposes described in the table below. The lawful basis
for such processing and the associated retention periods are also set out in this table.

Page 1 on 3

PURPOSE

LAWFUL BASISRETENTION PERIOD

Consent

3 years from the end of the commercial
relationship (last connection to the accountor date of last purchase) or earlier in theevent of consent withdrawal

Performance of the contract

5 years from completion of the order

Consent

Retention by the payment service provider
for 60 months after purchase

Performance of the contract

10 years

For tickets and membership card sales
Creation and management of anonline customer accountManagement and monitoring oforders and sales of tickets,membership cards and of
exchanges following modificationor cancellation of an event
Credit card number retention for
future purchases
Invoicing, monitoring payments

For visits
Management and control of accessto the Bourse de Commerce(including for membership cardholders)
Guided tour management andplanning
Drawing up sales and visitorstatistics
Carrying out satisfaction surveys

Performance of the contract

5 years from completion of the order
5 years from completion of the service

Legitimate interests pursued
by Pinault Collection(improving offers, getting toknow customers better)In the case of customers and prospective
customers, data is deleted or anonymised 3
years after the last contact from theprospective customer or customer, or thedate of the last purchase or the expiry dateof the membership.

For the management and optimisation of the pinaultcollection.com website
Legitimate interests pursued
Tracking website operation,
by Pinault Collection
audience statistics and people's(improving offers, getting toDetails are given in the cookies policy
browsing habits via cookies
know customers better) andconsent
For marketing operations
Sending information emails on
Pinault Collection news andpromotional offers to newsletter
subscribers
Organising events and sending
invitations and information on
Pinault Collection news by post or
email to professional
clients/prospects

Consent

Until you request to unsubscribe or, in thecase of a customer account, until theaccount is deleted

Legitimate interests pursued
by Pinault Collection

For customers and prospective customers,
data is deleted or anonymised 3 years after
the last contact from the customer orprospective customer.

Page 2 on 3

For processing requests for information
Communication and exchange ofLegitimate interests pursued
information following requests
by Pinault Collection
sent to dedicated email addresses

3 years from the date the request wasprocessed

For processing visitors and customers requests regarding their personal data
Management of requests fromindividuals to exercise their rights
6 years from the date of the request toLegal obligations
regarding the processing of theirexercise a right
personal data (right of access, rightto object, etc.)
For recruitment operations
Processing job applications
5.

Pre-contractual measures

Throughout the recruitment process

WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA?

Your personal data may be communicated to the following recipients, depending on their responsibilities andthe purposes for which they are to be used:-Pinault Collection staff working in the marketing, publicity, administration, IT and legal departments;
staff responsible for control (audit, compliance, DPO) within Pinault Collection;
Palazzo Grassi and Punta della Dogana (to control access to the museums for holders of membership cards);
subcontractors involved in the processing of personal data (e.g. reception service provider, online payment
service provider, guided tour service provider, ticketing software publisher, digital marketing agency);
employees of companies involved in financial or legal transactions concerning Pinault Collection.

6.

IS YOUR PERSONAL DATA TRANSFERRED OUTSIDE THE EUROPEAN UNION?

To provide its ticketing software, Pinault Collection uses subcontractors located in Switzerland and Vietnam.
For these subcontractors, and in accordance with the applicable data protection provisions, data flows to thesecountries are governed by agreements drawn up on the basis of the model contractual clauses proposed inSwitzerland by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and by the European
Commission, in compliance with the provisions of Article 46 of the RGPD.
7.

WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA AND HOW CAN YOU EXERCISE THEM?

Under data protection law you have the following rights regarding your personal data: right of access, rights torectification, right to object to processing, right to erasure, right to withdrawal of consent, right to restriction ofprocessing, right to portability and right to define directives relating to the retention, deletion andcommunication of your personal data after your death.
These rights may be exercised by contacting our Data Protection Officer (or DPO) by email:
dpo@pinaultcollection.com, or by post: Pinault - Collection - DPO - 48 rue Montmartre, 75002 Paris. Proof ofidentity may be requested.
You can also send a complaint to the CNIL at the following address: 3 place de Fontenoy - TSA 80715 - 75334
Paris Cedex 07 or via its website https://www.cnil.fr/fr/plaintes.

Page 3 on 3