Privacy policy
Introduction
MUSIAM Paris attaches great importance to your personal data. We are committed to offering you customised services – whether we are processing or managing the confidentiality or security of your personal data – while respecting your privacy and personal choices.
This document is our privacy policy (hereafter the “Privacy Policy”). Whether it is personal data which you have provided directly, or which one of our companies has collected through the various contacts you may have had with us (in-store, customer service, restaurants, website, social networks, digital applications, events, competitions), we want to inform you in a straightforward, transparent, and comprehensive manner how your personal data is processed and how it may be transferred to third parties. This Privacy Policy also covers your rights and options to control your personal data and to protect your privacy pursuant to prevailing regulations.
When you visit, make a purchase or browse Les Ombres website, you may find yourself switching from SO.FE.REST to MUSIAM Paris and vice versa. Thus the data controller – within the meaning of applicable regulations on the Protection of Personal Data, and particularly with regard to Article 24 of Regulation (EU) 2016/679 (hereinafter “GDPR”) – will either be SO.FE.REST or MUSIAM Paris.
About us
Les Ombres, operated by SO.FE.REST, is a limited liability company with a single shareholder and a capital of €40,896.00, whose registered office is located at 1 Esplanade du Foncet, Immeuble Bords de Seine, 92441 Issy-les-Moulineaux cedex, France. It is registered with the Nanterre Trade and Companies Register under number 329 815 914, and is represented by Lyonel Nowitz, its managing director.
MUSIAM Paris is a simplified joint stock company with capital of €10,000.00, registered with the Nanterre trade and companies register under number 822.001.509, with a registered office located at 3 Esplanade du Foncet, Immeuble Bords de Seine, 92441 Issy-les-Moulineaux cedex, represented by Lyonel Nowitz, its managing director.
MUSIAM Paris means all of SO.FE.REST. affiliates and partners with whom your information may be shared. Below is a list of all the brands and company names that come under the umbrella of MUSIAM Paris :
- SRML – Société de Restauration Musée du Louvre
- SRMLC – Société de Restauration Musées et Lieux Culturels
- SRMO – Société de Restauration Musée d’Orsay et Musée de l’Orangerie
- SO.FE.REST – Musée du quai Branly
- SO.FE.REST – Bibliothèque Nationale de France
- SO.FE.REST – Château de Versailles
- SO.FE.REST – Salons Air France Longs Courriers CDG
- SO.FE.REST – Ducasse Réception
What information do we collect ?
Personal data is information relating to an identified or identifiable natural person.
We may collect your personal data directly from you with your consent (e.g. when you visit one of our websites, buy a product in one of our online stores), or indirectly (e.g. when you visit one of our websites, or fill in electronic forms or applications (“digital platforms”) from your computer, tablet, or mobile phone).
You may provide us with information directly, in one or more of the ways described below when you :
– create an account online or in our stores
– make a booking at one of our restaurants
– subscribe to our newsletter
– use our digital platforms
– purchase products or services on our digital platforms or in our stores
– participate in one of our events
Depending on what information you have provided, such data may include :
– your personal identity (including your first name, last name, and gender)
– your contact details (including postal and email addresses and telephone number(s))
– your personal status (including your title or form of address)
About Us
– your preferences (dietary, contact method, etc.)
– certain payment information (including billing data, type or method of payment, credit or debit card number)
– other information you may provide by filling in forms or contacting us (including your ratings, reviews and comments, or any other correspondence you have with us).
Some of this information is needed to answer your requests or to provide you with products or services. If you refuse to provide this information, it may result in delays or even mean we are unable to handle your request.
In order to provide you with the best possible experience, we encourage you to update your information if it changes.
Lastly, we recommend that you only disclose data that is strictly necessary or related to your request, and that you exclude any sensitive personal data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, and sex life or sexual orientation.
Information collected indirectly :
When you use our digital platforms, we may collect data indirectly for the purpose of operating, analysing, customising or optimising your digital experience. This data may include your IP address as well as other browsing information (browser used, operating system, device characteristics). To do this, we use cookies or similar technology placed on your device.
If you would like more information about cookies, please see our Cookie Policy.
In the course of our business, and specifically in the case of third party orders (e.g. gift certificates or an order where the billing and delivery addresses differ), we may collect information about you from third parties. In this case, the person providing your personal data must ensure that they have the right to provide it to us and that we can collect, use, and disclose it in accordance with this Privacy Policy. If for example you would like to gift one or more of MUSIAM Paris’s services or products, you must make sure that the person receiving the gift is aware of the information described in this Privacy Policy. The same person must also consent to the way we process their personal data as per this Privacy Policy.
How we use your data
We may use your personal data in different ways, depending on the relationship you have with MUSIAM Paris. It should be understood that, depending on why we have collected it, we may use one or several items of said data. Below we have listed how we use the data collected to :
– Manage your orders
– Provide you with personalised content and communications from MUSIAM Paris
– Manage your booking
– Manage your subscription
– Manage any requests you may have regarding MUSIAM Paris
– Manage our website and digital applications
– Improve our products and services, image and reputation
– Manage transactions (secure online payments, fraud prevention, payment and debt incidents)
– Send a generic newsletter : you have the right to opt out if you no longer wish to receive it
– Personalise our advertising and targeted offers
The data is collected in order to :
– Analyse the performance of our brand on third-party websites and social networks in order to produce statistical analyses (market research, brand influence, and analysis of campaigns implemented).
– Analyse your preferences and habits, anticipate your needs based on your consumer profile and from your posts/mentions on social networks.
– Bring you a personalised customer experience: we may provide you with tailored messages and marketing offers via email, post, SMS, or phone calls. With your freely given, specific, informed and unambiguous consent (where required), we use your personal data to send you personalised, interest-based messages (newsletters, offers, advertisements, special offers, invitations and surveys).
We may also send you personalised messages or content in which we use techniques known as profiling and fully automated decision-making. Under Article 4 of the GDPR, profiling is defined as processing that uses an individual’s personal data to analyse and predict behaviour. Meanwhile fully automated decision-making is defined as a decision made about an individual, through algorithms applied to their personal data, without any human involvement.
Pursuant to Article 22 of the GDPR, there are specific provisions governing fully automated decision-making, whether or not these decisions are based on profiling. Thus, as a matter of law, you have the right not to be subject to a decision based solely on automated processing, including profiling, if it would produce legal effects concerning you or similarly significantly affect you.
In the case of fully automated decisions, you have additional rights as set out below :
- Specific transparency obligations: in addition to this policy informing you about the existence of this type of decision, you may at any time, by simple request to MUSIAM Paris’s DPO (musiam.business@ducasse-paris.com), obtain a full list of this type of processing and the underlying logic.
- Right to human intervention: any person who has been the subject of a fully automated decision may request that a human intervene, in particular in order to re-examine their situation, express their own point of view, obtain an explanation of the decision taken or even challenge it.
All of the aforementioned purposes require a lawful basis for processing your data, which, depending on the context, may be :
– Your explicit consent: for example, for the purposes of managing our personalised marketing offers, managing your browsing via cookies under the terms and conditions defined by our Cookie Policy, or establishing your consumer profile, if applicable
– Execution of a contract e.g. to process and track your orders, access your customer account, join our loyalty programme, etc.
– A legal obligation when processing is required by law, for example, by keeping purchase invoices to prevent fraud
– Our legitimate interest: e.g. to improve our products and services, defend ourselves, or secure our tools
How long do we keep your data for ?
We may keep your personal data for a variable period of time, depending on the purpose. Whether it is personal data which you have provided directly, or which one of our companies has collected through the various contacts you may have had with us (in-store, customer service, restaurants, websites, social networks, digital applications, events, competitions), we want to inform you in a straightforward, transparent, and comprehensive manner how your personal data is processed and how it may be transferred to third parties.
Customers (with a profile on our digital platforms or an in-store customer) – 5 years from the date of the last purchase interaction
Prospects (e.g. who have subscribed to a newsletter, but who have not made a purchase) – 3 years from the date of data collection. This retention period may be renewed by any means of consent during the retention period, or during any interactions with Maison Ducasse Paris (e.g. newsletter registration, participation in a competition)
At the end of the aforementioned retention periods, your personal data will be deleted or anonymised so that it is no longer possible to identify you (this excludes data that is subject to legal and/or regulatory obligations including transactions, claims, and litigation).
Who can access your data ?
Your data is solely intended for the MUSIAM Paris department concerned by your requests. We take great care to ensure that only duly authorised persons can access your personal data, and only when this is necessary for the aforementioned purposes.
We do not share your data with third parties for commercial purposes.
We will only disclose your information to the following third parties on a need-to-know basis, and then only in such a way that direct identification is not possible:
– Other MUSIAM Paris entities where you may purchase our products, in order to provide you with the best and most consistent customer experience possible
– Our trusted third party service providers, including other MUSIAM Paris entities, acting as subcontractors according to our instructions and only on our behalf. For example, we may need to pass your personal information to third parties in charge of delivering your orders, or who help us manage our customer relations/customer service.
– Our trusted third party partners who assist us in managing your orders. In particular, we outsource certain services to third parties who are responsible for delivering products to you, to payment service providers, and to providers of anti-fraud transaction security. Please note that our partners may act as data controllers in their own right. As such they will have their own privacy policies :
– Third parties who would like to know your interests so that they can build up similar audiences and target prospects who match your profile. For this specific type of processing, we are not the data controller for prospecting and you will not be prospected, your data is used solely to build up profiles similar to yours.
Below is a list with some examples of our third-party partners :
- The Fork (privacy policy available here)
- Facebook (privacy policy available here)
- Google (privacy policy available here)
- Instagram (privacy policy available here)
- Official authorities in the course of performing a task in the public interest, such as establishing, exercising, or defending legal claims
You may also choose to disclose your personal data to our partners, advertisers, and affiliates by following a link to and from their website. Please note that these websites have their own privacy policies.
How do we protect your data and ensure its confidentiality ?
MUSIAM Paris pays particular attention to the security and privacy of your data. We take all necessary and useful precautions to ensure that none of your data can be distorted, damaged, destroyed or accessed by unauthorised third parties.
All of our partners, as well as any companies that are part of the MUSIAM Paris group, are required to have a level of protection similar to ours regarding your personal data. As risks and threats are constantly changing, protection and security updates are regularly carried out, pursuant to the laws and regulations prevailing in the countries where we operate.
How do we handle cross-border data flows ?
You should be aware that data protection and security requirements differ from place to place, and may not offer the same level of protection as those in your home country. As some of your data may be collected, accessed, and stored outside your country of residence, we inform you that MUSIAM Paris has taken necessary and sufficient measures to guarantee the security and confidentiality of your data by applying methods approved by the European Commission and/or national data protection authorities.
In this context :
– SO.FE.REST. and all MUSIAM Paris companies have signed a Personal Data Processing and Transfer Agreement
How are consumer preferences and individual rights addressed ?
Maison Ducasse Paris is committed to respecting good data protection and security practices, as described in this document, including for residents of the European Union/European Economic Area under the EU General Data Protection Regulation (GDPR) 2016/679.
In particular, GDPR provides the following rights:
– Right to be informed: you have the right to clear, transparent and understandable information regarding your rights and how we use your personal data. You can find all of this information in this policy.
– Right to withdraw consent: where processing is based on consent, you have the right to withdraw your consent at any time
– Right of access (article 15): you have the right to access the personal data that Maison Ducasse Paris holds about you
– Right to rectification (article 16): for as long as your personal data exists you have the right to have obsolete personal data rectified or completed if it is incomplete.
– Right to erasure (“right to be forgotten”) (Article 17): apart from any legal obligations or our legitimate interest in keeping your data, you have the right to have your data erased or deleted.
– Right to data portability (Article 20): you have the right to move, copy or transfer data from our database to another. This right applies only to data that you have provided, and only if the processing is based either on a contract or your consent, and is carried out by automated means.
– Right to object (Article 21): you may at any time ask to no longer receive marketing material from us about our offers, news and events. You may use the hyperlink provided for this purpose in each email or message we send you. You may also ask to receive non-personalised marketing about our products and services. Pursuant to the French Law for a Digital Republic, you – or one of your legally appointed representatives – also have the right to issue specific or general directives determining how to retain, delete or communicate your data after your death.
In accordance with the law, MUSIAM Paris has adopted practices to avoid collecting or storing information about children under 18 years old. If we realise that we have mistakenly collected information from persons under 18, we will immediately purge said information, except to respond to a one-off question or request from the individual concerned or their parent or legal guardian.
How can we be contacted?
If you wish to exercise these rights, or if you have any questions or complaints about the processing of your personal data please contact us as per the details below :
Email : musiam.business@ducasse-paris.com
Post: MUSIAM Paris, Data Protection Officer
1-3 esplanade du Foncet
92141 ISSY LES MOULINEAUX
You also have the right to contact the French Data Protection Agency (CNIL) in order to lodge a complaint against MUSIAM Paris’s data protection and privacy practices. The CNIL can be contacted as follows:
Commission Nationale de l’Informatique et des Libertés – CNIL
3 Place de Fontenoy
TSA 80715 – 75334 Paris, Cedex 07
Tel. +33 1 53 73 22 22
Fax +33 1 53 73 22 00
Website: http://www.cnil.fr/
