In order to (i) use the website https://www.bataclan.fr (the “Website”), (ii) obtain information about the activities offered at the Bataclan (the “Venue”) by the ‘Société d’Exploitation des Spectacles Bataclan’, a simplified joint-stock company with share capital of 100 000 €, whose head office is located at 50 boulevard Voltaire, 75011 Paris, listed in the Trade and Companies Register of Paris under the number 702 012 931 (the “Company”), (iii) create a User account and (iv) use the Services, the User is required to provide the Company with Personal Data about him or her.
The creation of the User’s personal account (the “User account”), and use of the Services, entails full and complete acceptance of this Agreement.
The Agreement can be accessed from each page of the Website and is included by means of a reference in the General Terms and Conditions, which can be found at the following address: www.bataclan.fr/fr/charte-confidentialite.
The following terms and expressions beginning with a capital letter in the Agreement shall have the meaning indicated below, whether they are used in the singular or the plural :
Denotes this confidentiality agreement, intended to inform the User about the undertakings made by the Company in its capacity as a Data Processor, to respect the User’s Personal Data while the User is (i) creating the User account, (ii) using the Services, (iii) browsing on the Website and, finally, (iv) contacting the Company in order to request permission, if need be, to exercise the rights accorded to him or her by the Data Protection and Freedoms Law as amended (the “LIL as amended”) and the General Data Protection Regulation dated 27 April 2016 (the “GDPR”).
2.2 User account
Also known as personal space: denotes the personal space created by the User via the Website and accessible on the Website using a personalized user-name and password, enabling the User, amongst other things, to (i) create a user account, (ii) order and pay for one or more tickets for any production taking place at the Venue, (iii) access the e-ticket(s) included in an order if this form of ticket was chosen when the order was placed, (v) subscribe to, or un-subscribe from, the Venue’s newsletter and (vi) agree to receive commercial offers from the Venue’s partners.
2.3 General Terms and Conditions of Use (“GTC ”)
Denotes the terms and conditions, which may be accessed at the following address: www.bataclan.fr/fr/cgu on the Website.
2.4 Personal Data
Denotes the User’s personal data, collected and processed when the User registers and creates the User account, uses the Services, and navigates around the Website;
2.5 Data controller
Denotes the Company which determines the Purposes for which and the manner in which any Personal Data are to be processed by the Venue.
Denotes all the services offered by the Company on the Website, particularly within the User Account, as well as requests to subscribe to the Venue’s newsletter made using a dedicated form, or requests for information made using the dedicated contact form.
Denotes any person who has occasion to use the Website, whether they have a User account or not.
The purpose of the Agreement is to define the undertakings made by the Company in its capacity as a Data controller, having regard to respect for the Personal Data of the User collected and processed when creating the User account, during Use of the Services, when browsing on the Website or when contacting the Company.
4 Personal Data collected
In its capacity as a Data controller, the Company collects and processes 3 categories of Personal Data when the User creates a User account, browses on the Website and uses the Services :
4.1 Identification data of the User
In order to (i) create a User account, (ii) use the Services, the Company collects and processes information about, and the Personal Data of, the User, including their surname, first name, physical address, email address, and telephone number.
In the forms for contacting the Website, signing up for the Venue’s newsletter or registering for a User account, the fields marked with an asterisk (*) are mandatory and are strictly necessary in order to allow the Company to process the request for information. If the User does not fill in the fields marked with an asterisk (*), the Company will not be able to process the request.
The User’s answers in any fields on these forms that do not have an asterisk (*) next to them are optional.
4.2 Bank details
For the purposes of paying for all orders, the Company collects and processes the bank details (bank card number, expiry date, visual cryptogram) of the User.
4.3 Connection data
The Company also collects the IP address and cookies, specifically those referred to in article 11 of the Agreement, when the User visits and browses on the Website.
The User is (i) notified in advance about the collection and processing of Personal Data concerning him or her and (ii) must agree to it, by providing confirmation through a click of the mouse or by ticking a box, in the context of the information and consent notice at the time the Personal Data is collected when the User subscribes to the newsletter, fills in the contact form, or creates his or her User account.
5 Purposes of the processing
The User is hereby notified that his or her Personal Data shall be subject to computerized processing, kept updated and operated under the responsibility of the Company, acting in its capacity as the Data controller for the following purposes/services (the “Purposes/Services”) :
- creating and managing the User Account,
- managing the order,
- controlling access to the Venue,
- contacting the User;
- sending out newsletters from the Venue,
- drawing up statistics and aggregated research reports which help to improve algorithms, to measure and understand how the Services are used and, furthermore, to develop new products, services or functionalities. Profiling is specifically dealt with in article 13 hereof.
The Personal Data will only be used to the extent that they are strictly necessary in order to implement the Purposes and Services.
The above processing in relation to identification Personal Data and banking data is not performed in response to any regulatory requirement but is necessary for the performance and management of the contractual relationship, for processing the User’s requests, or for performing the Services.
6 Recipients of personal data
The information and Personal Data collected and processed by the Company is strictly intended for the Company and the sister companies and/or those of the group to which the Company belongs, to their subcontractors (including partners and service providers), the staff they employ, specifically authorised in strict compliance with the Purposes mentioned above, and, finally, for the judicial and/or administrative authorities.
The Company may have occasion to communicate the User’s Personal Data to its subcontractors (including its partners) with the aim of processing requests from Users, including commercial companies, for the conducting of statistical studies to analyse the use of the facilities and services in the Venue and the preferences of the Users, in order to improve the Services.
The subcontractors are required to respect the confidentiality and security of the Personal Data which may be communicated to them and only to use it in the context of the performance of their role as subcontractors or service providers.
The Company does not transfer any Personal Data outside the European Union.
The Company guarantees that the Personal Data of Users will not be disclosed to any unauthorized third parties whatsoever, without the consent of the Data subject.
The Company does not sell or lease the Personal Data of Users to third parties.
In certain specific circumstances, the Company may have occasion to disclose the Personal Data, when it is demanded by the competent judicial and administrative authorities.
7 Retention of Personal Data
The Personal Data shall be retained by the Company for a period which does not exceed the length of time strictly necessary in order to achieve the Purposes for which it was collected, as set out above, and in all cases, cannot be kept :
- for more than sixty (60) days as of the moment the User exercises his or her rights, and in particular the right to erasure or transfer of the Personal Data, drawn up by the User to the Company ;
- for more than three (3) years after the commercial relationship with the User, for Personal Data, and for a maximum of three (3) years from the last time the User made contact with the Company ;
- throughout the period during which the User has a subscription to the newsletter, plus any legal time-frames pertaining to the provision thereof and, if applicable, plus a period of 3 years, during which the User may be invited to re-subscribe to the newsletter ;
- until full payment has been made, for the User’s Bank data, in the context of the Service ;
- for one (1) year for so-called “traffic” data, in accordance with the legal obligations incumbent upon the Company.
Upon the expiry of these periods, the Personal Data will be securely archived for the necessary retention and/or limitation periods resulting from the applicable legal or regulatory provisions.
8 Rights of the User
The User has the rights listed below :
- a right of access, i.e. a right to obtain confirmation from the Data processor about whether or not the Personal Data concerning him or her is being processed and, if they are, access to the said Personal Data, as well as various information including the Purposes of the processing, the category of the Personal Data concerning him or her, the recipient(s) of the Personal Data, etc. ;
- a right to rectification, as soon as possible, of any Personal Data concerning him or her that is inaccurate, incomplete, out-of-date or equivocal, or of Personal Data, the collection and processing of which is prohibited ;
- a right to object to the processing of Personal Data by the Data controller or to a transfer of Personal Data, unless there are legitimate and compelling grounds which prevail over the interests of the User.
- a right to the erasure of Personal Data concerning him or her, for the following reasons :
- The Personal Data is no longer necessary having regard to the Purposes for which it was collected or processed by the Company ;
- The User has withdrawn his or her consent, on the basis of which the processing took place, and there is no other legal grounds for the processing of the Personal Data ;
- The User objects to the processing of the Personal Data and there is no higher interest justifying said processing ;
- The Personal Data was processed unlawfully ;
- The Personal Data must be erased in order to comply with the legal obligation to which the Company may be subject ;
- The Personal Data was collected when the person concerned was a minor.
- a right to arrange, in advance and during his or her lifetime, the conditions under which the User wishes to have retained and communicated, after his or her death, the Personal Data that the Company has collected and processed ;
- a right of portability and recovery of Personal Data, enabling the User to receive the Personal Data that it has transmitted to the Company in a structured format, commonly used and legible by a machine, and to transmit them to another Data processor, without the Company to whom the Personal Data was initially communicated being able to prevent it ;
- the right not to be the subject of a decision based exclusively on automated processing, including profiling, producing legal effects concerning him or her or significantly affecting him or her in a similar way.
If the User wishes to exercise one of the aforementioned rights, he or she may send a request to the Data Protection Officer, by email, to the following address: email@example.com or by post, for the attention of the Data Protection Officer, to the following address: 8 rue Saulnier 75009 Paris, France.
In the event that the User exercises one of its rights by email, the Personal Data will be provided, if need be, by electronic mail, by the Company when this is possible, unless the User has specifically requested otherwise.
9 Security of Personal Data
The Company takes sufficient, adequate and pertinent security measures, in order to keep the Personal Data secure and, in particular, to prevent them being deformed or damaged or to prevent unauthorized third parties from accessing them.
These measures include, in particular, the implementation of the following procedures:
- Protection of servers storing personal data by means of firewalls, anti-spam filters and anti-virus filters ;
- Encryption of personal data using an SSL protocol ;
- Disclosure of a fault, vulnerability or security breach, by the person concerned.
The Website is not intended to be used by minors under the age of sixteen (16).
To enhance the User’s experience, the Company may have occasion to deposit, collect and process cookies on the User’s computer when the User logs in and browses on the Website.
Cookies are little packets of information stored in files inside your computer’s browser.
The cookies only store the identification code in their memory, to the exclusion of all of the User’s other Personal Data. Thus, the depositing of cookies, performed in the context of the use of the Site, does not make it possible for the User to be personally identified, but records information about the browsing performed from his/her computer on the Website (pages viewed, dates and times of visits, etc.) that the Company may read during the User’s later visits to the Website.
The collection and processing of cookies enables the Company :
- to record all information pertaining to the User’s browsing on the Website and, in particular, all information pertaining to the pages viewed and the dates and times at which the Website was viewed ;
- to enhance browsing on the Website so that different functions can be used, including identification in particular ;
- to draw up statistics and volume data for visits to and use of the Website (sections and content viewed, route, date and time of visit, browser used, etc.), making it possible to make the Website more interesting and user-friendly. In order to do this, the Website uses the Google Analytics tool.
- to recognise all Users’ browsers as registered previous visitors, in order to remember all the preferences which may be sent during use of the Website ;
- to adapt the way the Platform and/or Mobile Application is presented to the display preferences on the User’s computer (language used, display resolution, operating system used, etc.) during their visits to the Website, depending on the equipment and the visualization or reading software that their computer uses.
Cookies shall not be kept for more than thirteen (13) months as of the time they are first deposited in the User’s computer.
To this end, and for the technical cookies which do not have the sole purpose of enabling or facilitating browsing, or for functional cookies which are not strictly necessary in order to benefit the Services, an information strip is displayed when the User first logs into the Website, to notify Users, prior to the depositing of said cookies (i) about their presence and their precise Purposes and (ii) enabling them, if need be, to object to the storing of them on their computer and change the settings by clicking on a link contained in the information strip and (iii) informing them that by continuing to browse on the Website, they are deemed to have expressed their consent to the storing of cookies on their computer.
Users may withdraw their consent at any time and object to the use of said cookies by changing the settings on their Web browser. We would like to draw your attention to the fact that refusing to accept cookies, particularly cookies other than “third-party cookies”, could result in your browsing on the Internet being impeded or even blocked.
When it comes to managing the cookies and your options, the configuration of each browser is different. It is described in the Help menu in the User’s browser, which will enable the User to find out how to change his or her preferences in relation to cookies.
By way of illustration, you can follow the steps set out below:
In Internet Explorer :
Open the Internet Options menu, then click on the Privacy tab. Using the vertical cursor, you can choose between several levels of settings that apply to all the Websites you visit. Once these general rules have been established, the Websites button allows you to choose settings that are specific to certain sites. For example, to block cookies from our site specifically, type the web address https://www.bataclan.fr into the box, then click on Decline.
You can also visit the following web-page and follow the instructions set out there: http://windows.microsoft.com/fr-xf/windows7/block-enable-or-allow-cookies.
In Google Chrome :
In the Chrome menu, click on Settings, then Display advanced settings, then Privacy, then Content settings. In the Cookies section, several options are proposed. Some of them apply to all the sites visited (e.g.: “Stop third-party websites from recording and reading cookie data” which amounts to blocking all cookies, and only retaining local data until I quit my current browsing session, or “Allow sites to record and read data” which amounts to allowing them). Once these general rules have been established, you can define settings specific to certain sites. For example, in order to block cookies from the Website, specifically, type https://www.bataclan.fr into the Block section, then click on the Add button on the right. You can give your consent to the Website in the same way.
You can also visit the following web-page and follow the instructions set out there: https://support.google.com/chrome/answer/95647?hl=fr.
In Mozilla Firefox :
To block all cookies for all websites, go to the Menu and click on Options, then click on the Privacy and Security pane. Adjust the Retention rules under the option Use customized settings for history, then un-tick the box marked Accept cookies.
In addition, the Exceptions button allows you to choose settings that are specific to certain sites. For example, to block cookies from our website specifically (if you have left the Accept cookies box ticked), type the address https://www.bataclan.fr into the Address of website field, then click on Block.
You can also visit the following web-page and follow the instructions set out there: https://support.mozilla.org/fr/kb/activer-desactiver-cookies-preferences
12 Commercial prospecting
The Company may have occasion to collect and process Personal Data for the purposes of commercial prospecting via the sending of electronic prospecting communication, either directly or by its partners.
In such scenarios, each User is (i) notified in advance that commercial prospecting operations are being conducted and (ii) when the Law requires it, must consent to it through the ticking of a box either when creating the User account or in the section that can be accessed within the User account, under the “Newsletter and alerts” tab.
The User retains the option to object to the collection and processing of his or her Personal Data for the purposes of commercial prospecting by un-ticking, at any time, the boxes in the “Newsletter and alerts” section if need be, by contacting the Personal Data correspondent at Société d’Exploitation des Spectacles Bataclan, 50 boulevard Voltaire, 75011 Paris, France or by sending an email to: firstname.lastname@example.org, attaching valid proof of identity.
The Company may have occasion to collect and process the Personal Data of Users, whether they hold a User account or not, for statistical purposes, to analyse use of the Services.
The processing is based on the legitimate interest pursued by the Company, characterised by the contractual relationship between the user and the Company.
14 Amendments to the Agreement
The Company reserves the right to amend the Charter and shall notify the User by means of personalized notice sent by email.
In the event that the new provisions do not suit the User, the User must stop using the Website.
15 Governing law
The Agreement is drawn up in French and is subject to French law.
All disputes shall be brought before the competent French civil authorities and courts.